It's possible to edit subscriber-controlled fields on public records of public custom metadata types via the metadata API, even if those records are included in a managed package. The main thing you need to remember is that both the type and the record will have a namespace in this case, so if they come from the same managed package, the full name of the record will be
packagens__TheType.packagens__TheRecord
Update for Summer 17:
Starting in Summer 17, you can asynchronously edit subscriber-controlled fields on public or protected records of public or protected types, so long as they're visible to your package's code (so, public or in your package or using your package's type), without needing to perform a callout, using the new Metadata package in Apex. You can also create new records of public or protected types--but note that new records are creating into the subscriber's namespace, not yours, so the only way to keep them hidden is if their type is protected and installed.