From what I can see, if you choose to handle security externally, security includes timeouts. So you'd have to add a system to your externally handled security component to manage session timeouts.
Unfortunately there is none. The overriding presumption with SpwdSetExternalUser is that you the developer own the entire login/logout process. This includes session timeouts.
So in a nutshell when a users login attempt hits your external handler function, you need a way to track the user and how long that user is logged in. Because handling is done externally, the web server does not have access to authentication details.