we are running into the same problem here… multiple large project with a lot of private dependencies that are also developed and changed all the time.
My idea was to use git submodules and store them in the /lib folder but the dependency finder does not look at subfolders of lib to determine if a dependency might already be there and end up cloning the depencies again in .pio folder.
Cloning the dependencies outside of the project folder is no solution for us as it will make github action builds much more difficult as I have to download all needed dependencies explicitely in the action in stead of relying on the dependency finder of platformio cloning them automatically on a build run.
There is an issue in the platformio core repo about handling submodules in the /lib folder, that might solve the problem but not a lot of activity on that one lately. Improve handling library.json dependencies · Issue #2573 · platformio/platformio-core · GitHub
At the moment we handle this by manually committing changes in the .pio libdeps folder from a terminal window.