Permit private (access-disabled) projects to be used by other projects for build dependencies.
Other private projects need no special permissions
Public (access-enabled) projects must be whitelisted by the private project
This is via an in the private project's meta config
Users with read permission for a public project but not for a project it depends on may view the public project's meta config but will not be able to (safely) save it.