Hi @MikeM
for activities as mentioned execution guarantee is at least once, and at most once if retries are disabled via configuration on retry options for this activity.
For the idempotency, yes, in your scenario your activity in most cases should be idempotent,
If not possible, I think you could use heartbeating. You can include business level info in the heartbeat and if activity fails (due to timeout as you mentioned) and is retried, your activity can get the last heartbeat info and can decide to continue activity work from a specific position recorded in the last heartbeat, decide not to re-invoke a 3rd party service, etc.
Here is a thread with a similar question that I think has really good info as well.