You can recommend that users use packrat with your package, e.g. by adding instructions in the README and/or a vingette.
The .Rprofile file added by packrat automatically activates packrat whenever a user starts R from that directory. Thus as long as you have that project-specific .Rprofile bundled with your R package, you can instruct users to use install package as follows (assuming it is available online in a Git repository):
git clone https://.../myPkg
cd myPkg
Rscript -e 'packrat::restore()'
Rscript -e 'devtools::install()'
Prior to running devtools::install(), packrat will download and install all the exact depenencies. And then to use the package, they should always start R from the myPkg/ directory.
But of course this won't work if they instead install your package via remotes::install_github() or similar.
Is there a reason you need exact versions of the dependencies to use your R package? You can specify minimum required versions in your DESCRIPTION file.
Update: Recent versions of packrat don't automatically run packrat::restore() when R is opened in a project. Thus I added the explict step of running packrat::restore() to the hypothetical installation instructions.