Is it possible to specify a user who is external to the current AFS cell on an ACL?
No. You cannot reference a particular user from another AFS cell. You can specify an IP address on the ACL; this means any and all users from the host with that IP address. Another solution to this problem is to give the external user an “authentication-only” account in your AFS cell. This means that (s)he can klog (but has no home directory) in your cell.