Is it ok to update external_id on discourse database?

In that case you could either

a) synchronize all accounts to discourse using the SSO sync mechanism
b) keep track of which accounts have been used to log in to Discourse
or
c) when you merge, do an external ID lookup to determine which account(s) have been used with Discourse