You could maybe use AnyConnect VPN into the MX.  With RADIUS authentication, it would be possible to use Meraki Group Policies to apply a different set of network access controls to contractors, versus your employees, if that's the primary concern.   https://documentation.meraki.com/MX/AnyConnect_on_the_MX_Appliance#Group_Policies ... View more

6to4 is a tunnel as opposed to translation. The MX doesn't have any way to forward based on IP protocol number so I don't think you're going to be able to do this in the way that's being asked.  ... View more