Monitoring Network Devices Outside Firewall

Hi Guys! We have several devices outside of our firewall that we are currently not monitoring (other than ping). Some of these items are BGP routers and internet switches. What is the best/safest method to expose these to the internal management network so we can fully monitor, take config backups, etc? Is out of band management really safe to be plugged into an internal network? Should we just create ACLs that allow our internal monitoring software to reach these devices and enable ssh,etc from those specific IPs? Thanks!