Often, a professional environment teaches us to be more concerned with appearance and offending each other than we really should be. This issue isn't about who's eating someone else's lunch out of the shared refrigerator. If your workplace has to care about the O.F.A.C. then someone's been accused of a federal crime. This an extremely serious situation where the contractor may need to be investigated by law enforcement. Full stop. They will have the resources to address this appropriately. You need to be the adult in the room. If the tipster is wrong then they will need to apologize, and if either party has lied then you should fire the liar. Were I dealing with this myself, my short answer is that I'd require the "tipster" to speak to law enforcement. If the tipster wasn't willing to do that then I would explain to the tipster that they have alleged a felony has taken place, and avoiding a police interview really isn't up to them.
You also asked: What else can be done to mitigate risk to the company? What steps can be taken to mitigate tipping off this contractor, such that they may retaliate with further damage to company?
While your mental alarm bells are going off the fact is that any damage has already been done. Either the info you shared can be changed or not and a penetration tester has either found vulnerabilities or they haven't, have left something behind or they haven't. If the contractor turns out to be operating illegally then they will simply not be around to retaliate after law enforcement gets involved.
A quick note about temp agencies: The term "temp agency" is not precise, and gets applied to different types of staffing. According to the industry's own statistics only about 10% of the temp placement industry is advanced technical work like engineering or penetration testing. Over half is low-level clerking work such as data entry, and about a third is janitorial, construction, or warehouse work. Their own industry's data shows an average ten week placement. This may not be the correct way to discuss your choice in staffing service. The following presumes that you're working with a service such as Robert Half, Randstad, WeWork, Allegis, etc.
So how much of a background check makes sense? The first thing to understand is that not all background checks are equal. Since any temp agency is going to want to provide a job placement so they can start collecting their fee they won't dog very deep. All a temp agency is going to do is get consent for a basic criminal background check, which they're going to run using the provided name, date of birth, and social security number. If that person really exists somewhere they're not going to know who they're really dealing with. Common practice in the industry is to run a drug test as well. Were I the one hiring from a temp agency I'd never staff for a position that had to respect O.F.A.C. Something run through a credit firm with a quick pull by S.S.N. from the F.B.I.'s database is a far cry from a full B.C.I. or anything the military would do for compartmentalized clearances. Every type of background check has a different process and a different level of scrutiny. Most background checks do not involve any in-person investigation. Figure out what level of scrutiny you really feel is appropriate going forward. Set a policy that matches.