Internally I do something very similar: drop the information to a share on my machine with read permissions set to the right people.

As you say, things can be more complicated for externals. I often don't have write access to much that they can read from, without putting in a request through infrastructure, for obvious separation-of-concerns reasons, because things we host/manage directly for them are well locked down, anything at their end is too, and most of our clients have white-list-only access to other resources.