we have a custom build script that generates an interpreter bundle, then we push that to developer machines and use /etc/pexrc+PEX_PYTHON to hook into that for all pex execution while keeping the itnerpreter entirely off the users $PATH (so they can’t pip install into its environment etc)