@m13op22!
Indeed your users will have to install the packages your package depends on, unless they have them already on their system (which might often be the case for popular packages!). They will need to update these dependencies only if your package indicates a minimal version in DESCRIPTION for instance
Imports:
commonmark (>= 1.6)
You might be interested in
I'm wondering why you want to keep your package self-contained? Approaches that might be of interest depending on your use case might involve Docker. Or maybe if you don't want anyone to install your package you could provide an API to your package via plumber. So really it will depend on your use case (and personal preferences). 
Last note, for projects packrat is superseded by renv (by the same author).