Do you allow SARs to be sent externally to examiners for review or do you require these be reviewed onsite/in-person?

Only if it is done on an absolutely secured system.

And how would we go about determining this?

All of the primary bank regulators have their own secure file transfer/storage service. It's a pain to get access to, but it's worthwhile to transfer all secure documentation if an examination team is not onsite.

Under no circumstances should you email SARs or place SARs on an encrypted drive. I would suggest asking your EIC for access to their secure file transfer portal. Or, you could provide them access to yours, if your bank has such a system.