Do you enable external file sharing in Microsoft 365, and how do you secure it?

I'd start with a dedicated SharePoint site for external collaboration and keep internal sites closed to external sharing. You can also limit who is allowed to share, rather than enabling it for everyone.

Put an expiry on links where the sharing method supports it, and set up alerts for new sharing links. Users also need to understand the folder hierarchy. Sharing a parent folder can expose far more than the one document they meant to send.

Another option is to require named guests instead of allowing anonymous links. With the appropriate guest sharing setup, you can apply MFA requirements and review guest accounts and permissions regularly.

You can also restrict sharing to approved domains and use Purview DLP policies to flag or block sensitive content. Sensitivity labels can add restrictions based on the content, though the policies need to match how people actually work.

Keeping Microsoft 365 external sharing disabled is a valid choice, but give people an approved way to send and receive files. Otherwise the need doesn't go away, it just moves to whatever service someone can find.

A separate file exchange tool can work if it meets the business and security requirements. Include incoming files in the discussion too, not just what your staff send out.

Whatever route you pick, be careful with external links arriving from other organizations. A familiar company name doesn't prove the sender or its account is safe. Verifying unexpected sharing requests through a known contact is a useful extra check.