Hi,
Do they need access to a single internal machine or multiple machines? The safest approach is to configure a dial-up VPN. However, if you are looking for a simple port forwarding type of solution. You could add a MIP to the untrust Interface, create a custom service for the ports, create your address objects and add a policy to permit the external machines to the internal host via the MIP (Untrust to Trust). Make sense? Let me know.
Rgds,
John