The package manager is not involved in calls to using, and I think you mean LOAD_PATH instead of DEPOT_PATH. The load path decides what you can using, and what X means in using X, but when the given package has been determined, julia will look for the installation of that package in all DEPOT_PATHs.
You can modify the load path to include only your home project/active project as follows:
$ export JULIA_LOAD_PATH=@
$ julia -E 'Base.load_path()'
String[] # Can't load anything.
$ julia --project=. -E 'Base.load_path()'
["/home/fredrik/Project.toml"] # Can only load whats in this Project.toml file.