How do you provide record access to external users, and how does the choice of license change the design?

The first question is always which license, because it determines which mechanisms are even available.

1. Customer Community is a high-volume license. Those users have no role, cannot be referenced in sharing rules, and cannot be added to the role hierarchy. Access comes from sharing sets, which grant records by matching a field on the record to the user's related Account or Contact. Internal users get access to records those external users own through a share group on the sharing set.
2. Customer Community Plus and Partner Community are role-based. Each external account gets an account role hierarchy, records roll up within that partner or customer account, and those users can be used in sharing rules and public groups.

There is also a separate external organization-wide default per object, which cannot be less restrictive than the internal one.

The architectural trap is choosing the license on cost and discovering the sharing constraint afterwards. A design that assumes tens of thousands of external users each participating in sharing rules is describing a role-based license at a scale and cost that usually was not budgeted.