As far as I understand the JSON:API specification the relationship object must point to a JSON:API resources.
Relationships
The value of the
relationships
key MUST be an object (a “relationships object”). Members of the relationships object (“relationships”) represent references from the resource object in which it’s defined to other resource objects.
For use cases like the once described by you I usually use an attribute, which value is a URL to fetch the data. E.g. an user
resource may have an avatar
attribute, which is an URL pointing to an image. Similar an attachment
resource could have a content
attribute, which is an URL to download the raw content of that attachment.