I think you should first check your license agreement. If it says that upgrades require dbo access, you should give them dbo access. What if you call in a week later about a bug, and they find out that you tripped them and says "support contract voided, you will have to pay through the nose".

If you want to limit the access of the upgrade, you should not put them in db_owner at all, but only grant the permissions you think they need.

And you may get away with it this time, but next time, the vendor may actually want to make changes to the schema.

Full disclosure: my main client is a vendor, so I am that side of the fence.