What is the suitable sharing option for ensuring that external users with a specific profile can only access their own records of a custom object?

Setting the external sharing model to 'Private' is the most suitable option for ensuring that external users with a specific profile can only access their own records of a custom object. When the sharing model is set to 'Private', it restricts access to records so that only the record owner and users above them in the role hierarchy can view their records.

This configuration is particularly important for maintaining data security and privacy for external users, as it ensures that they cannot see or modify records owned by others. In scenarios where external stakeholders need to interact with the system but only with their specific information, a 'Private' setting effectively enforces this constraint.

The other options do not provide the same level of granularity required in this case. A 'Public' sharing model would allow all users to see all records, which is contrary to the requirement. While ownership-based sharing rules can grant additional access based on ownership, they are not necessary when the 'Private' sharing model already restricts access appropriately. Criteria-based sharing rules can be useful for broader use cases but may complicate the simple need for users to only access their own records. Therefore, 'Private' is the ideal choice for this specific scenario.