[Skunkworks] On demand VPN setup

Hello All I am running some systems which more often than not are supported by contractors outside the country. For some of my contractors,i have site-to-site VPNs with them. The trouble i have is i do not want to have a site-to-site VPN because it is always up. Does anybody know how one can have an on-demand VPN when needed. ie incase a contractor needs to login and do a patch,they inform me what time they want to login;then i allow them at that particular time. Any ideas are welcome Regards