What are best practices for supporting and upgrading a list of contributed and custom Drupal module?
Using an Install Profile can really help with these situations.  Have the consultant create a profile and manage the modules they are responsible for in profiles/[PROFILE NAME]/modules.  You will be responsible for everything that is in sites/all.

You can use https://www.drupal.org/project/profiler_builder to easily generate an install profile from an existing site.  https://www.drupal.org/project/profile_switcher can be used to convert a site started with a standard install to use a profile.

https://www.drupal.org/project/profile_status_check is also useful to visually see which modules are being loaded from profiles/[PROFILE NAME]/modules vs. sites all as well as break out custom modules (regardless of location) vs. contrib.

Install profiles are as easy as developing a custom module.  Most people are only familiar with the Install Profiles that are included in Popular Drupal Distributions like OpenAtrium and Acquia Commons. Distributions are more difficult to manage.  They require drush make and/or .make files to manage contrib modules as well as 3rd party libraries.  

While going to a full blown Distribution makes sense in some use cases, just using an Install Profile could be an elegant solution to defining who is responsible for different modules in your use case.