I think your main question is about the external_id field. You need to set an external_id field in the DiscourseConnect payload. The value of the field should be some string that is associated with the user that will never change. I’m assuming that your application has a users table. The primary key for a user’s entry in that table would be good to use for the value of the external_id field.
If a user created an account on Discourse prior to your having added DiscourseConnect authentication from your website, the first time they log into Discourse through DiscourseConnect, Discourse will attempt to find the user based on the email address that’s in the DiscourseConnect payload. After finding the user, a record will be added to the Discourse database that contains the external_id from the DiscourseConnect payload. The next time the user logs in, they will be found by the external_id instead of by the email address. (Note that this doesn’t work if you set the require_activation parameter in the DiscourseConnect payload to true.)
Discourse has good fallbacks for most edge cases. There are issues related to users having multiple accounts and email address that can trigger errors. Some details about dealing with those cases are here: Debug and fixing common DiscourseConnect issues.