@Jo If the whitelist is a mandatory thing and you don't have a way to avoid it, the only option I can think of from the top of my head is a gateway(it could be a Server, VPS, Cloud) with static IP Address that you would have to use as a middle-man/gateway to receive the communication from NetSuite and send it to the third-party

Thanks for your inputs. This seems the only way.

They may be able to use outboundips.netsuite.com