I would go with an external lookup field, with the caveats that:
1) I think you do need to account for whether the user can see the programs (I usually do this with an API key for example
2) I am not great at API calls, so I just did it in a way that I wouldn't have to think super hard about it.
...