There are a number of ways to do it.
I have a few external systems (customer and sales portals, for example), that integrate with NetSuite. For the customer portals, I've setup custom entity fields in NetSuite to store the username and password that has been assigned to a customer. The custom Web app makes a SuiteTalk REST call, or a call to a RESTlet, to handle the authentication.
I hope that helps. Good luck!