Sorry for the late reply here. I'm actually uncertain how packrat's installation of private packages works... I know it does record the SHA of the commit it installs, so it should be able to install the correct version from GitHub. I'm just not sure what hooks you have into the authentication process for the download. I think it uses a function like devtools::install_github(), so I suspect it should work as long as you can install the package from GitHub that way. Otherwise, I would say definitely open an issue in the packrat repo.
About having too many dependencies, etc. - one option that may benefit you in packrat, at least, is:
ignored.directories: Prevent packrat from looking for dependencies inside certain directories of your workspace. For example, if you have set your "local.repos" to be inside your local workspace so that you can track custom packages as git submodules. Each item should be the relative path to a directory in the workspace, e.g. "data", "lib/gitsubmodule". Note that packrat already ignores any "invisible" files and directories, such as those whose names start with a "." character. (character; empty by default)
you can see details in
?`packrat-options`