It’s complicated… and not really documented anywhere as far as I can tell.
As for making a registry, see Creating a custom registry. This worked for me.
For unregistered dependencies, Pkg cannot track the chain of dependencies (this is issue 810). So you need to add unregistered dependencies “by hand” in the right order. For example, if A depends on B depends on C, you need to add C first, then B.
If you want to add a package with a specific commit (rather than the latest), I believe you can specify the the git sha in the PackageSpec and then use add (I have not tested this, though). But you would still have an install script - I don’t see a way around this without a registry.
But please take what I am saying with more than a grain of salt. I’m not an expert, which is why I pointed you to the “How to activate” thread where more knowledgeable people chimed in.
PS: In case it’s useful, I write up what I have figured out here (precisely b/c I have trouble finding documentation on workflow issues and also following the various threads on discourse. Perhaps useful.