Generalising these questions a bit helps me match this to my experience in the games industry, where small developers often partner with goliath studios and distributors. Note my subtle rewordings in questions below.
What are the key metrics I need to consider in taking this arrangement forward?
Trust is most important of all. It's difficult but worthwhile to measure. I personally tend to distrust "partners" that require any form of exclusivity, especially long term or proprietary lock-in of any sort, because those only limit your ability to escape a bad deal later for better horizons. Big studios are able to gobble up small developers cheap by merely withholding contract payments near the required product delivery time, to make the developers more desperate for buy-out liquidity. Product delivery timing is often much more specific in contracts than payment timing, which makes the small developers more vulnerable to breach of contract litigation even when they are working without sufficient payment.
- How do I structure this partnership so as not to lose control?
Given the mismatch in size and capability here, I'm not sure you can retain any control in such an integrated solution without being absorbed into the mothership and given leadership over your one engine piece, so to speak. For true independence and control, your best bet is finding *multiple* integration partners that you can load balance and play off each other. I find that most load balancing techniques require a minimum of 3 for redundancy in case 1 falls through. They will not like sharing you with their competition, so this increases the pressure to create industry-wide "must have" features that they can't sell without.
- Should I chase investment, buy-out, merger, cross-licensing ... mix of these?
You started this out asking about retaining control, and I don't see how you can retain any independence without gaining investments or customer buy-in independent of the goliath partner(s). You also said IoT not SaaS (though "management cloud apps" are confusing the distinctions a little), so do whatever is necessary to keep your physical manufacturing pipelines distinct. The software pipeline is much harder to keep distinct after integration, so use license-free and open standards whenever possible, because that prevents both future customer lock-in and bigger "partner" enterprises from taking it from you later via litigation. Unfortunately in IP law cases it's often the side with the most expensive lawyers who wins, not the true innovators or implementors.