One other alternative design I could imagine here is having two separate repos: one for public content and one for private content.
The private content repo itself could be kept private (you could determine who has access to it independently).
1 Like