I don't understand, these are their offices, but do they also have MX in these locations? Do they have auto VPN configured?
In fact, there is a lack of information, if you can provide more information.
I'm sure if I try to access your resources I won't be able to, the only thing that justifies them accessing your resources is if they are participating in the auto VPN.
I am not a Cisco Meraki employee. My suggestions are based on documentation of Meraki best practices and day-to-day experience.
Please, if this post was useful, leave your kudos and mark it as solved.