What is the best way to give a theme developer site access without compromising security?

I run a community site where a couple of my users have offered to develop new site themes. However, I'm not sure what the best practice is that would allow them to develop a theme without risking my site getting totally ripped off (ie using php to dump the database to a file, etc) or damaged in the process.

I was thinking about providing some straight html pages saved from the site for them to just rework the css with but that doesn't allow for actually changing the drupal theme code... Any suggestions from those wiser than I?

Thanks!