Externally powering LEDs so Arduino doesn't fry

VCC and AVCC can each support 200mA - so 400mA total.
The ports should then be limited to 300mA:
3. Although each I/O port can source more than the test conditions (20mA at VCC = 5V, 10mA at VCC = 3V) under steady state
conditions (non-transient), the following must be observed:
ATmega48A/PA/88A/PA/168A/PA/328/P:
1] The sum of all IOH, for ports C0 - C5, D0- D4, ADC7, RESET should not exceed 150mA.
2] The sum of all IOH, for ports B0 - B5, D5 - D7, ADC6, XTAL1, XTAL2 should not exceed 150mA.
If IIOH exceeds the test condition, VOH may exceed the related specification. Pins are not guaranteed to source current
greater than the listed test condition.

So at 360mA, you're pushing it some.
Best bet is to use a couple of external shift registers such as TPIC6B595 that can sink the higher current amounts.
78 cents from avnet.com
https://avnetexpress.avnet.com/store/em/EMController/Counter-Shift-Register/Texas-Instruments/TPIC6B595N/_/R-1750249/A-1750249/An-0?action=part&catalogId=500201&langId=-1&storeId=500201&listIndex=-1&page=1&rank=0