There are several ways to deal with this. I am working on a similar user validation system, where the actual user registration and user validation is managed by an application external to MODx. I don't really want to duplicate the user data for thousands of users in the application and in MODx, requiring all kinds of back-and-forth activity every time a user's information gets updated.
The application I'll be accessing has a SOAP service for handling this sort of thing. Since MODx checks the $_SESSION when checking for a valid user, a plugin can be used on page request to make a SOAP request to the application, checking if the user is logged in to the application, fetching appropriate information to populate the $_SESSION array for MODx to access as required. MODx itself doesn't need to permanently store any data about users. This method would mean that your application must have some kind of API for accessing this information. My case will probably be slightly different, as the actual login form is provided by MODx, it just gets POSTed to the application interface instead of a page in MODx.
Another method would be to duplicate the users in MODx, then pass a token to MODx on page request, using a plugin to trigger a login to MODx as if the user had actually logged in using the MODx system events.
http://rtfm.modx.com/revolution/2.x/developing-in-modx/other-development-resources/class-reference/modx/modx.invokeevent