Yes, Sitefinity Cloud supports external code repositories outside of your Azure DevOps organization. We are using a service connection to connect external repos to the CI/CD and the automatic upgrade pipelines.
Depending on the type of repository, there are different options for authentication, including personal access tokens (PATs), username/password credentials, etc.
In terms of permissions, the connection requires read and write permissions in order to have both the CI/CD and automatic upgrade pipelines working properly.
The CI/CD pipeline requires read permissions and the automatic upgrade pipeline requires both read and write permissions. Write permissions in the auto upgrade pipeline are required to create the branch with the code changes from the upgrade.