I need to give a permission to our company parter which will provide us with new leads. 

I planned just to create user for them and than with specific permisisions so they can generate token for them and by using zoho api insert data related to leads. But I need to be sure that they can only insert data through api but not fetch data, so they provide their leads but can't touch our's leads. 

How can I do that in zoho crm?