I actually just did this exact requirement yesterday. You can create a custom Identity Provider by implementing "ExternalIdentityProvider" and overriding the authenticate method to perform your authentication.
This code was extremely helpful for me in completing this task https://github.com/Adobe-Marketing-Cloud/aem-ldap-tutorial/tree/master/step-04/example-idp/src/main/java/com/adobe/gems/exampleidp/impl
My version hits an external REST API, performs the authentication and then utilizes AEM for syncing the user details.
If you choose this method you'll need to have a configuration added for DefaultSyncHandler and ExternalLoginModuleFactory.