If the stylesheet originates from the Web site of a trusted business partner, you want to grant the transformation a permission set that includes FileIO.
You would like to run the transformation under default Internet zone permissions.