There are three ways I've seen it done, though it being Google I assume there's more

One is to try the bidirectional support with copybara itself, thought that usually requires more effort than it's worth.

Another is to have the external repo be the source of truth and then always import into google3. Kythe used to do this at least, though I gather it's not done that way anymore.

The third is to just replicate the patches externally (which is pretty easy to automate or semi-automate on a case by case basis), and verify that a re-copybara-export keeps zero diff