Both are possible in principle, but they work under different conditions. Embedding inside the Pega portal depends mainly on whether the external dashboard and its Okta/SSO setup allow iframe embedding, while opening in a new tab is usually the easier and more reliable option if both apps trust the same identity provider.
You can place an external dashboard in a Pega landing page only if the target application allows being loaded in an iframe and its security headers do not block framing. If the external site sends X-Frame-Options: SAMEORIGIN or a restrictive Content-Security-Policy frame-ancestors, the browser will block the embedded view regardless of what Pega does.
Launching the dashboard in a new browser tab is the better-supported pattern. If the user is already authenticated through the same IdP and the external site is correctly federated with Okta using SAML or OIDC, the user can often access the target application without logging in again because the browser already has a valid IdP session.
On the Pega side, you mainly need a clean way to launch the link, such as from a landing page or portal action, and ensure your own SSO configuration is correct. On the external side, you usually need the bigger changes: the app must trust the same IdP, support SAML/OIDC properly, and if embedding is required, allow iframe usage through Okta Trusted Origins and compatible framing headers