I found a snippet which indicated that porcelain can checkout a specific revision if passed the hash of the parent revision in argument refspecs. It seems to work for me, but is non-obvious.
from dulwich import porcelain
target='local-repo'
refspecs=[b'abcd.....parent-hash.....ef']
porcelain.clone("https://github.com/mystuff/repo", target, refspecs=refspecs)
Is there a way to fetch the head and then checkout a specific revision; refspecs=None will clone the latest, but how to do a checkout escapes me?