Contract.
They get the nameservers until the name is paid off (or, if you're leasing, for the duration of the lease).
You retain control of the domain itself.
If you want to get persnickety, you can put something in the whois details that denotes you're the lessor, or that the domain is under contract.
One of our larger apps, I lease back the domain for $1 a year to the partnership. The terms are casual enough, the whois information is completely in the name of the partnership but my contractual protections are there behind the scenes and my relationship to the partnership is as a partner whereas your relationship with them- as the domain seller/lessor- is more adversarial, requiring more robust CYA protections.
Tactically speaking, it's usually better to keep segregated domain ownership as quiet as possible, as it's a hugely lucrative landmine should the enterprise get sold and the buyers weren't diligent enough to realize the domain didn't come with the sale. You won't wind up holding all the cards, but you'll have three quarters of the deck.