Best Approach to Enable External Document Upload Without Exposing the Case in Constellation

I have a requirement where an external user should receive an email, open a link, upload a document, add comments, and submit the information. The user should not have access to the complete case view.

I explored Web Embed with the Authorization Code grant type. It redirects to the login page, which is expected. However, after login, the embedded page is unable to pull/render the assignment (blank screen).

Also, Web Embed seems to require the assignment to be hosted in a web application, so I’m not sure if it’s the right approach for this use case.

Is there any out-of-the-box solution (such as Email Channel, DWA, or another feature) to expose only a document upload + comments screen without exposing the full case?