R – SharePoint domains and Content Query Web Part

I would say you need to use SharePoint's alternate access mapping to use the correct authentication type depending on the method users are using to access the website.

Basically i think this would work as follows for your situation:

1. For internal users, use the default zone, using NTLM with SSO configured.
   Thus users should be signed in transparently without requiring to login.
2. For external users, extend the web application, using the extranet zone, using anonymous access.
   This will allow external users, to browse the website without signing on.

See: http://blogs.msdn.com/sharepoint/archive/2007/03/06/what-every-sharepoint-administrator-needs-to-know-about-alternate-access-mappings-part-1.aspx

Might be one of the properties on the webpart that has a value from where it was exported from (Site?).

http://msdn.microsoft.com/en-us/library/microsoft.sharepoint.publishing.webcontrols.tableofcontentswebpart_properties.aspx