I have searched extensively, but have not found anything useful. Can anyone offer any advice?
I've solved this issue.
Instead of worrying about syncing two authentication sources (external + regular Joomla), I did disable the Joomla authentication plugin, and updated my custom plugin to check if the code is being called from the front end or back end, and if back end, handle Joomla logins manually from the #__users table.
The users are still auto-created, but the problem of out-of-sync user accounts is now moot, and non-admin users in Joomla can be cleared automatically every night to prevent bloat.