This is my suggestion,
Create a new repository in order to place all your binaries at output artifacts. In your central repository, the one that xlinks to the external 'Third party' repository, create a new xlink to the new brand new "Binaries" repository.
Now you will need to change your build system to copy all the binaries and artifact to this xlinked repository. A (cm ci -a) command will commit all the changed binaries, finally label the changeset with the "cm label" command, this label will help the QA team to test certain releases.
Remove the view permission for the QA Plastic SCM group at the central repository and the "Third party" repository. Now the QA group will never know that there's even a source code repository. The QA group will have a workspace working with the "Binaries" repository and your source code/repositories will be safely hidden and not accesible by this QA group.
You can even have the "Binaries" repository in a external server/machine. So the source code is in devMachine:8087 and the binaries are in a different Plastic SCM server, for example "qaMachine:8087". Using this methodology the QA Plastic users will be using a dedicated server.