If I mention an external user in a private repo, does that grant them access to the conversation/branch/repo? And if so, does removing the conversation will withdraw the access?
No, a user's access is not modified by whether you mention them. For example, if at work I mention a former colleague (e.g., “That was written by @octocat, who's no longer here.”), that user does not get notified at all and doesn't get any access to that repository.
Doing so would be tricky because it would allow people to gain access even when they definitely should not have access (former employees, project members who have been asked to leave for inappropriate behavior, etc.).