I don't think there is a perfect solution to doing this in R CMD build, but there are some other options.
Under a Unix-alike only, an executable (Bourne shell) script cleanup is executed as the last thing by R CMD INSTALL if option --clean was given, and by R CMD build when preparing the package for building from its source. [1]
So you could potentially put these steps in a cleanup script, you would have to somehow condition the vendering to occur only when run during R CMD build.
Alternatively you could download the dependencies during R CMD INSTALL instead by putting them in the configure script, this is probably the most straightforward solution, but of course assumes internet access during installation. Note if you go this route configure is only run for source installations, so users installing the binaries would not need to download the vendored dependencies. This is probably the route I would recommend.
See the configure example in Writing R Extensions for more details on using and customizing configuration.