How should I validate field values against an external service?
As you want the field value to be validated, I would use a constraint, This ensures that the value is validated regardless of how the field value is saved - whether through a Form, an API (REST/JSON etc) or programatically.

As you didn't create the entities and fields yourself (I'm assuming you mean they're provided by a module or core, and not just that a former developer created them), you'll have to attach your constraint in hook_entity_bundle_field_info_alter() as explained in this post: How do I add a custom validation handler to an existing form/field?

Note however that this will mean anytime your entity has saved, and this field value has changed, your remote API will be called. If this is going to happen regularly, you may want to create some kind of caching system that caches the responses from the remote API.