At work we’ve been using devpi happily for more than 5 years. We’ve discovered quite after the fact that (at least) one of our private package names had been picked up by a public project without impact (we also deter employees from using --extra-index-url for performance reason, which might also explain that) so I completely support the “devpi” answer 
Nevertheless, I agree that it would certainly feel “safer” to know that our package names can’t conflict with a public one. From the mentioned solutions, a Name prefix: co:package matches co:package (and no colons allowed on PyPI) would have my preference as I don’t see major hurdle in the implementation.
An other solution I did not see mentioned here and that might be worth exploring would be a lightweight PEP-503 private index/proxy that developers could launch on their computer and that could implement all kinds of routing/filtering between multiple private/public indices, package directories, S3 buckets, etc. Developers would simply point pip to this local server with --index-url and be setup.