We use different files for "soft" requirements, dev/test requirements, and a freeze.txt containing all production requirements and then we default to installing from freeze.txt but can update from the other files. It's similar to this[1] but generating the freeze.txt in a temporary virtualenv.

I've started using an generated offline cache and PIP_FIND_LINKS to remove the dependency of pypi for known installs in one project as well, will be interesting to see if it turns out to be a good idea or not.

[1]: https://www.kennethreitz.org/essays/a-better-pip-workflow