Providing production MySQL access to outside company
Your approach seems to be sound. However, I am unsure of what real business intelligence can be gleaned if the reporting is made off of incomplete data. Create a dedicated user with limited privileges (IE No writing/dropping allowed). There is always a tradeoff of information security and information quality. 

Perhaps it would be best to understand what you're hoping to accomplish with this reporting and identify what sensitive info can be removed.