Hi Dave:
For #1, it looks like your Authentication Provider “ExternalSF” may need to be tweaked. Set your Grant Type to Resource Owner Password Credentials in the Auth Provider configuration, and you get the option to specify a Credential Source on the Data Source config screen. Here’s our documentation on the setting. This is where you enter the username and password for your custom guest user.
#2. Build / update the pages you want to use on your site to use this External SF data source. For existing pages, you can update the XML so that the models are pointing to the new External SF data source rather than the original Salesforce Data Source. This is the page you will share via VF using sites. The site viewer will still be an unauthenticated guest user, but because the pages are using the External SF data source, guest users should be able to access the data according to the permissions you’ve assigned to the custom guest user.
Again, make sure that the custom guest user only has the view and edit permissions that they absolutely need so that your site remains secure.
