I haven’t tested it yet, so it may be false. However, you could have the user sign up the first time, and make a data field not allowing them access to any vendor until they do something that allows them access to it. When they are allowed access to it is when you could allow the vendor to see the customer’s details.
So under your vendor’s data type, you could have a field that is a list of users. Then, only allow the users that are in that vendors list access to their store or what not.