security - How do I make sure an apt upgrade doesn't pull in malware from a PPA?

I sparingly add PPAs for things like resilio-sync, and more up-to-date versions of key software.

I'm worried that if I do an large upgrade, any one of those PPAs might provide a version of something I don't want it to. Maybe it's a compromised system library, or maybe it just isn't a desirable source for a particular piece of software.

Is there a way to lock down a PPA to only provide certain packages?

(This is not a duplicate of this one as that question is about excluding specific packages from a PPA... I want to only allow specific packages).