Do suppliers need to give access or install anything for a connected score?

No. ThingsRecon builds the connected score from the outside, starting from your own domains and using passive discovery. Suppliers don't fill anything in or grant access. The connections it finds are the ones visible on the public internet, which is why private links still need checking separately.