Is it possible not to use the users from table act_id_user, and make them it's virtual, ie, when a user logs means the external system, we are register a virtual Activiti user and dynamic bind to it role and then run the business process? And after step task, we notify users by own logic to signed groups.
It's possible to override the IdentitySession, providing user and group info to the engine and through API. Here, you should contact the third party system.
Look on the forum for "custom identity session" or look in Activiti in Action "10.2 Managing the user identities in an LDAP server".