Why not create an account for them? it can be something as simple as stu00001 with 00001 being their ID or pass number or whatever you see fit.
External entities can have their own "account" format.
if you set them both as not null, then you need to fill both. Instead use a constraint to verify that you get either one, but I doubt you need it. Like you said yourself, keep it simple. You are not building the accounting super-system, so just cover your needs.