If you have set up org relationships, the level of details configured therein applies to the entire organization (or the user's you've scoped it to). While users can configure more restrictive settings, they cannot override the org relationship default. So in your scenario, you can either change the org level to the most permissive setting and instruct users to restrict it where needed, or use individual sharing/sharing policies.
External sharing is always read-only, if they need edit access, they will need an account in your organization.