This view is supported by the ECJ C-40/17 “Facebook Like-Button” case. A fashion retailer included the FB like button on the web page. The court found that the retailer was not a controller of subsequent processing by Facebook (here, Facebook is its own controller). However, the two parties are joint controllers for collecting and transmitting the personal data on the page. While the ruling was made under the previous Data Protection Directive, it is entirely transferable to the GDPR. In your scenario the on-page processing is even more substantial.
: Which means that the website needs a legal basis for sharing data with the embed provider. For like buttons, the typical legal basis is consent, and loading the social plug-in is deferred until the visitor consents. This is more tricky for a reservation system because service may not be conditional on consent per Art 7(4).
The definition of a data controller is the party “which, alone or jointly with others, determines the purposes and means of the processing of personal data”. The hotel is clearly a controller here because it decides purposes and means. Using the third party embed is a means for the purpose of making reservations. The hotel has a responsibility to ensure that the purposes and means are in compliance with the GDPR.
It seems like the third party the hotels wants to use is not prepared to act in a GDPR-compliant manner, or to enable its customers to achieve GDPR compliance. Another reservation system should be used, or a the hotel should set a link to the reservation system's own web page, to make it clear that they are not responsible.