Azure Rights Management & O36 Security & Compliance

External users, already using Office 365 (whatever licence), which means they have Azure AD, can consume Azure Rights Management protected content.

"By default, the Azure Rights Management service uses an Azure Active Directory account and an associated email address for user authentication, which makes business-to-business collaboration seamless for administrators. If the other organization uses Azure services, users will already have accounts in Azure Active Directory, even if these accounts are created and managed on-premises and then synchronized to Azure. If the organization has Office 365, under the covers, this service also uses Azure Active Directory for the user accounts."

For other external users, there is RMS for individuals:

"RMS for individuals is a free self-service subscription for users in an organization who need to open files that have been protected by the Azure Rights Management service from Azure Information Protection. If these users cannot be authenticated by Azure Active Directory and their organization does not have Active Directory Rights Management (AD RMS), this free sign-up service can create an account in Azure Active Directory for a user. As a result, these users can now authenticate by using their company email address and then read the protected files on computers or mobile devices."

Also, check out https://support.office.com/en-gb/article/Office-365-Message-Encryption-OME-f87cb016-7876-4317-ae3c-9169b311ff8a:

"Another option is to email documents by using Office 365 Message Encryption with new capabilities. This email solution works for all email addresses on all devices and is the recommended way to safely share information and Office documents by email with people outside your organization."

Announcing new capabilities available in Office 365 Message Encryption

"The new message protection capabilities will be offered to Office 365 E3 customers and above. Office E1 customers may also receive the new capabilities by adding on Azure Information Protection P1 stand-alone."