I have a repository in Azure that on some points (multiple times) I need to merge from my repository to one that a client has permission (also mine in my Azure).

The client wants to have the code to make some changes along the development but i dont want to give permission over my repo, only to certain branch and having the posibility to still make the client its own branches and changes.

Whats the best way to achieve this?
2 repos, git submodules, some permission config on Azure or something else?