Assign programmatically created order to anonymous user
I think you may be thinking about this incorrectly. If I were you, I'd write a custom module that created a new path designed to create a shopping cart for whoever lands on it with the requested products. You can include a token or something in the URL to ensure each one only gets processed once, and you can redirect to /cart or some other route after the order is created to try to reduce duplicate carts.

This means on the secondary site you're just storing in a cookie or the session the product IDs that you'll then use to construct the cart when you pass them to the Drupal site via query parameters or something like that. It isn't really possible to create a remote session for someone and then force assign the session ID to them when they land on your site afaik.