We have historically solved this by running our own local PyPI servers, which means added burden in both system administration and people administration--figuring out who gets upload rights.
We sometimes sidestep the problem by creaing vendor libs, but that necessitates a lot of fooling around with VCSes, and it doesn't work so well with compiled libraries.