GFCIs can't be half switched
Unlike a regular receptacle (where you can break the tabs off to get two independent receptacles on one yoke), a GFCI receptacle has a single set of hot/neutral inputs, so it can't be "half switched", unlike a standard receptacle which will let you do that. So, putting the GFCIs at the receptacle locations is out.
Putting a GFCI outside isn't a great idea anyway
GFCIs contain a fair bit of electronics; this means that even with a "bubble cover" protecting them, they're still vulnerable to moisture that gets past the while-in-use cover. This means that it's better to put GFCIs inside; in addition, a GFCI inside can trip and protect the boxes outside if they do succumb to water infiltration.
But, there's a solution to this
Get a deadfront GFCI device, like the one shown below, and mount it inside in the nearest readily accessible location opposite from where the existing 14/2 terminates (picture is for exposition only).
Then, you can extend the circuit with a 14-2 from the LOAD terminals of the deadfront GFCI to the switch location. You'll need a weatherproof cover for the switch here, as depicted below (again, picture for exposition only):
Last but not least, you then can run 14/3 from the switch box to the receptacle boxes, with the black in the 14/3 as the always-hot and the red as the switched-hot. Other than needing an "extra duty" while-in-use receptacle cover (I recommend the metallic ones, as the plastic ones have a bad habit of breaking) and needing to be Weather Resistant receptacles, these are wired as any other half-switched receptacle is -- with the black (hot) pigtail to one brass screw, the red (switched) pigtail to the other brass screw, and the tab on the hot (brass) side broken off. The neutral pigtail goes to a silver screw and the ground pigtail goes to the green screw, as usual.