There is no magic. Creating Yum or APT repos boils down to having packages and their metadata in a structured format and making it consumable over HTTP. To get started, you can also inspect any upstream repo in your browser.
Good luck. Feel free to report back if you have more specific questions.
I don't think this gets at what they are trying to do. I think they want to set up access control to the repo. They want access to the repo to be private but also use it for themselves like any other repo.
I don't think this gets at what they are trying to set up. The want to set up access control to the repo such that someone with the URL of the repo can't get access it without being on an allowlist. In other words, they want private access to the repo they set up.
Maybe I'm not reading their description accurately, but that's how I took it.