Almost exactly describes my first food job in a spice plant: we were third party toller/copacker. We warehoused, processed, and packaged customer products having never taken ownership of the product nor the packaging they supplied. Our HACCP plan reflected only the equipment itself, based on categories of what we processed (spices, dehydrated vegetables, etc).
Facility was SQF, and auditors always needed time to adjust their thinking when it came to supplier and material approvals. We made sure our internal documents reflected that all product and packaging was not owned by us, therefore decisions regarding it were left to their owners. By contract, they were required to send COA's that the product was safe before we would accept it. They were responsible for packaging being acceptable. When we had holds, we had to segregate product and then get approval before disposal or other dispositions.
So for your 1st question: Make sure internal SOP reflects these are all customer driven. Make sure contracts handle selection of safe product and packages by the customer. Needs an additional clause that your plant doesn't purchase on their own, and that only materials from contracted customers is acceptable.
2nd question: It sounds good to me, but your internal programs for sanitation and processing/packaging have to be analyzed and judged safe for the product you handle. You have a responsibility for keeping everything safe while it's in your facility, so not every aspect related to that can be pushed back on the customer.
