That's not going to be easy.
First, I'd rule out the XML - that simply contains everything, and you could spend a very long time trying to clean the data for them.
SQL could do it (because you can do anything in SQL), but you'll need to do some quite complex queries to make sure you only show them public comments with issues, and capture all the information. For example, from memory, I know that extracting the on-screen data for one of our issues includes reads of the tables Jiraissue, jiraaction, changegroup, changeitem, worklog, customfield, customfieldvalue, and then the component and version fields have to be linked via nodeassociation, and you'll probably want to read user tables and other stuff too.
I think I'd be looking at some scripting (using the Jira CLI "plugin"), some code (SOAP/RPC) maybe, and I'd have to ask why they can't simply be told "here's an account, it can read everything, help yourself".
Another option though, might be data cleansing. Export your stuff to XML as usual, import it into a development/test standalone Jira (no need for a "proper" one - the local hsql database will do), delete all the projects and comments you don't want them to see, then export it as XML and leave them to it.
You must be a registered user to add a comment. If you've already registered, sign in. Otherwise, register and sign in.