I noted that in a Communication site the users can see all the links in the menu regarding they have or not permission to the site.
Say that I have a Communication site with links in the menu to other team sites (site a, b, c). If the user 1 enter to the Communication site all the links are visible to him it doesn't matter if this user doesn't have permissions to enter to the site c. Offcourse if he clicks on the link c a page shows informing that he doesn't have permissions. Is not better that the link doesn't show in the first place instead ?
This is security trimming and a known limitation that Microsoft said they will be looking at adding to the comm site nav menu, but for right now this is intended behavior and something you have to work around.
There are some custom spfx solutions out there that I believe add security trimming but out of the box it is not supported currently.
Won't solve your problem for external site links but if you have a page in the site where permissions have been changed, providing you use the Promote option on the page and add to navigate, security trimming is applied.