Probably not very smart to use this feature, since your so-called "private" repository is an exploit or a leaking employee away from becoming public.
Instead, use a self-hosted Gitlab instance or similar, preferably with an external firewall preventing outbound and non-team inbound connections if feasible.
>>devit+(OP)
Your proposed solution handles neither the rogue employee nor the exploit scenario. It does incur a lot of additional cost in maintenance.