According to the PR preview documentation a PAT token is required to allow previews on external PR:

Authentication token for the preview deployment.
The default value works for non-fork pull requests to the same repository. For anything else, you will need a Personal Access Token with permission to access it, and store it as a secret in your repository. E.g. you might name that secret 'PREVIEW_TOKEN' and use it with token: ${{ secrets.PREVIEW_TOKEN }}.

Default: ${{ github.token }}, which gives the action permission to deploy to the current repository.