I work for a third party company that provides apps on behalf of other companies and have not found any easy solution to this.
What we have been doing is building an archive using their developer profiles/certificate (which they have to provide us with) and then they sign it for distribution using their distribution profile/certificates.
This means we have the ability to build and run the app but we don't have the ability to publish it nor have access to their Apple account.
However, the downside of this is, during the development and testing process before the archive is delivered, we can only build/install the app on phones if they are registered with Apple. And the limit for this is 100. The company we provide the app for is a very large well known company who have quite a lot of publishes apps and therefore Apple's limit of 100 development phones is too small, we have managed to get a couple of our phones registered with their Apple account, however our team of developers and testers and not to mention it needs testing on a wide range of devices means this is unsatisfactory.
So what we decided to do is have two versions of the app - create two workspaces which are identical to each other and share the same source code. The only difference being one of the apps has an apple bundle id registered to our Apple account and signing is automatic with our developer profiles, and the other workspace has an apple bundle id registered to the other company and signing is manual using their developer profiles.
Then for development and testing everything is done using the app registered to our Apple account, and it can be installed/run on as many iPhones as we want.
Then when its time for a release to be made, as a final sanity check the app with their bundle id can be installed and tested on one of the iPhone registered to their Apple account before an archive of that app is build and given to them.