How to run FUOTA in ChirpStack when using an external Join Server?

Short answer, I think you can't at the moment. The external join-server is responsible for storing the root-keys which in my opinion also means the GenAppKey, which is used to derrive the McRootKey, which is then used to derrive the McKEKey. All these keys are lifetime end-device-specific keys and thus (in my opinion) should never be known to a LNS when using an external join-server.

(in case of LoRaWAN 1.1+, the AppKey is used to derrive the McRootKey):

In order to make this work with an external join-server, I think it would need and API to given the McKey, obtain the McKey_encrypted and that API does not (yet) exist.