If we have a published distribution proj/lib and an app proj/app that depends on lib, but wants to lock down an older version (not keep up with the monorepo), what is the best pattern to use for this so Pants always runs, tests and packages the app with the published version of the distribution and not the first party local?

You should be able to pair an explicit dependency on the 3rd party and an explicit exclude on the 1st party. See "Ignore dependencies with ! and !!" here: https://www.pantsbuild.org/docs/targets#dependencies-field