Thanks @LaurenRyan. This is where we started, however the companies and contacts are also worked by internal resources who are selling other services. Because of this, all of the activity timeline is exposed to the outside organization regardless of settings. And, because of deduplication rules around emails, we cannot add a duplicate contact.
That all said, I think the current frontrunner for a solution may be to shift the location of the email address to an alternative email field, leave the email field blank, and create the contacts to be worked. If there is enough engagement, scoring, etc. to qualify them as an opportunity, we will run a workflow to copy the alt email to the system email field and then dedupe it.
For anyone reading this, are there any flaws in that logic? Appreciate all of the help!