Avoid ExternalProject_Add. You're better off using 'find_package', 'add_subdirectory', 'pkg_check_modules', or Conan depending on where your dependency comes from.

In my opinion, CMake is best as a (meta)build system, leaving packaging details to a different layer.