If you absolutely have to use repositories that offer the same packages, there are a couple of options that you can use:
You can assign a cost value to the repo files for those repositories. The default value is 1000, so if a repository has a lower cost, e.g. 999, it will be preferred over the other.
The second one is the priority value of the repository. Packages from a repository with a lower priority value will always get picked first, supposedly even if there is a more recent version of the package in question in another repository.
I suppose I could give the third-party repository a higher priority number for lower precedence, though cost seems redundant as it looks like it’s for breaking ties in priority. However that doesn’t deal at the package level.
From reading the docs linked, includepkgs is probably what I’m looking for, at least for my first question:
Include packages of this repository, specified by a name or a glob and separated by a comma, in all operations. Inverse of excludepkgs, DNF will exclude any package in the repository that doesn’t match this list.
That doesn’t “pin” a package to prioritize a specific repository, though perhaps combining includepkgs with a low priority number (high preference) on the repository might achieve this.
Also, the docs mention this affects DNF’s decisions, but do not mention the effect on other software upgrade mechanisms like dnfdragora, so it’s probably necessary to keep in mind that these options may not be respected universally.
In a scenario where you add a repository for a specific package, not found elsewhere, but where this repository also contains packages that exist in your other repositories and could cause conflicts, specifying a priority should be enough.
I honestly don’t know how other higher-level software deal with that, I remember that there where (are?) differences in dependency resolution, but I can’t recall someone talking about cost and priority.
In this case, and several cases I can think of, the package of interest exists in more than one repository. Priority won’t be enough on its own and could cause issues since I’m not sure of, and don’t want to monitor, what other packages are provided by that repository.