At my old work we would “freeze” CRAN, by downloading a complete dump of everything and setup R to install from that version instead of the online version as a way of version controlling packages.

So instead of defining our app to use version 1.4.5 of a package, we would use “latest version from 3rd of May”.