Adding SPF record on my company's domain(destination) for the purpose of validating an external vendor(source of email)

I am working on a request which says soandso.com will be sending emails to our xyz.com domain users ( our employees) and i should be adding an SPF record on my end to make their emails come in as if they are comming from our domain(xyz.com) itself.

If soandso.com were sending emails externally on behalf of xyz.com users, then you would create an SPF record in the xyz.com zone that included the sosandso.com mail server. Then external mail servers would check with your SPF record to see if they can trust the originating soandso.com mail server.

Maybe sosandso.com are sending emails to your internal users using sosandso@xyz.com, and your xyz.com email server is using SPF to determine whether to trust the source mail server. In that case, it will need the correct SPF record in the xyz.com domain to trust the soandso.com mail server.