Even though we had pinned all our dependencies (with requirements like package-x==1.2.3), pip would still reach out to PyPI before before deciding which version to pick.
Another solution for this would be to build wheels for all dependencies and invoke pip with --no-index -f https://url.to.wheels.