Drive Sharing Setting: Distributing content outside of your organization

[jones_matt]

Goal: We have a partner (external) organization with a Shared Drive that would like certain users to add files during a particular project. Our current settings are disallowing this as intended because currently "Distributing content outside of [your organization]" is set to "No one." At least for a short time I need to allow these users to put files in the external Shared Drive.

1. What are the most restrictive settings required to achieve our goal? Currently my idea is to make a group, and set the "Distributing content outside of [your organization]" to the value "Only users in [your organization]" for only that group. I think this would make exfiltrating files trivial, even to personal Google accounts.

2. Does anyone have clarity on the impact of the options for "Apps > Google Workspace > Drive and Docs > Sharing settings > Sharing options > Distributing content outside of [your organization]?" In particular, the documentation is pretty bad on the differences between "Anyone" and "Only users in [your organization]." What is the true difference between those two options? Source: https://support.google.com/a/answer/7662202#control_sharing_for_your_organization

Note: Adding the partner organization's domain to the Drive's Sharing settings > Alllowlisted Domains didn't help, sadly.