External sharing good practice

You can control external sharing settings at almost every level in SharePoint, for this reason I recommend allowing external sharing at the tenant level while setting more restrictive settings at the site and document level.

If your users need to collaborate externally and you don't allow external sharing at the organizational level, none of the sites or OneDrives in your org will be able to share through SharePoint. This only exacerbates the issue, if your users need to share a document externally they will find a way to share that information regardless of how it needs to get done.

So, would you rather external sharing happen in a place where you can have some vision and control or force your users to use another file sharing platform you have zero control or sight of? I'd rather provision sites as needed and at least maintain some control of who's sharing what, with whom and how.

With the introduction of Microsoft Teams external collaboration is even easier to set up, here you make a new team for the various projects and members of that team will have access to a Team site which is automatically created when a team is created. This way you can control access through the team rather then need to go back and dig through the environment and remediate all the direct access the users have been given when a project is finished.