PHP: authenticate for a REST request?

What do you mean by “external users”?
If you only want Users, that are logged into your website, to use the API Endpoint, you can filter the “rest_authentication_errors” like described here

Add this to your plugin:

add_filter( 'rest_authentication_errors', function( $result ) {
    if ( ! empty( $result ) ) {
        return $result;
    }
    if ( ! is_user_logged_in() ) {
        return new WP_Error( 'rest_not_logged_in', 'You are not currently logged in.', array( 'status' => 401 ) );
    }
    return $result;
});

Happy Coding!