Yes, the end user can create and enable links for external sharing in Office 365.  To disable it, they need to go to the individual document and turn it off manually.
You can also automatically control access with Azure Information Protection to automatically expire access to the document. his feature is available in Microsoft 365 which you can activate in a few clicks in your management portal, or via two PowerShell commands. 

Related Information: 

Watch how Azure Information Protection can help you protect your documents no matter where it ends up.