Ok, so it's TWO companies.
One is the marketing company that provides the website, the other is a local SEO company that created just the www version of our search console.
We own the domain, but the marketing company has the only access to the website files/ hosting. I'm guessing we are on a shared server with their other clients, so we will not get access. They have front end people on the team, but no understanding of SEO whatsoever. When I came on there was no sitemap or robots file submitted to search console, for example.
As far as the Search Console issue, I actually have a friend at that company there that told me their setup is proprietary. We no longer have a relationship with that company, and the owner of our company was also an owner on Search Console. I managed to remove all the reps from this company by unverifying, so that is no longer a problem! Maybe you helped me in spirit. I tried to do this a few times before and didn't find the way, but right after your response I did.
So now at least, the only issue is with the duplicate staging site and the ghost spam. I'd really prefer that the company take the staging files down. My employers paid a to of money for this site and are paying a large monthly retainer. At the very least we should have a clean build. It's over 4,000 duplicate pages, so I think that is going to have to be on them.
As far as ghost spam, I'll read the articles and get er done.
Thank you so much for your thoughtful response.