Why not have a password-protected repository per client? If you need public dependencies, build them once and copy them to all repositories.

HTTP supports inline username and passwords, use HTTPS to keep the password encrypted on the wire: http://username:[email protected]/...