I wouldn’t say ExternalProject is better for projects you don’t control. The advice I would normally give is to avoid mixing ExternalProject with non-ExternalProject things. Put another way, either go a full superbuild where everything is brought in via ExternalProject (so your main project is just acting as a layer that co-ordinates the different external projects), or avoid using ExternalProject. Otherwise, you end up having to manually specify a bunch of platform-dependent stuff. For me personally, I tend to look at using FetchContent first, and only fall back to ExternalProject for those cases where FetchContent isn’t appropriate (e.g. uses a different toolchain, has targets with names that clash with other things, sets or uses cache variables that have side effects on the rest of the build, etc.).
For FetchContent, it is certainly well-suited to dependencies you are in control of. However, you can also use it for other dependencies too, as long as they are well-behaved. The new features around integration with find_package() give you more flexibility, opening up opportunities for using FetchContent where it wasn’t really possible before. Keep an eye on this post, where I intend to provide some clearer guidance on this area once I get some other tasks out of the way.