Windows security pop up for external URL

So just to clarify from the original post, are you getting the logon prompt for external (Internet) users only, or for all users?

External users aren't ever going to be able to pass a Kerberos ticket, so you can either a) allow them to pass username and password credentials in the dialog for either NTLM or Basic auth, or b) filter on the client source address and do NOT try to do Negotiate auth for external clients.