I'm looking for guidance on vendor risk ratings. I know all should be rated but for a vendor that has no access to customer information are most banks rating that a "Low" even though the risk is essentially none? A rating of "None" doesn't make sense to me so I think they need something.

We have rated those "low" or "minimal"

How many tiers do you use?

I would start with your critical vendors such a core system. Score some of them and see how your rating system plays out. Take the same methodology and score some of your lower vendors. They may have to be modified over time, especially if you are just starting.