there's no difference between "private" deployment and "public" deployment. AGPL requires that if the client of the service asks for the source, you are obliged to give it to them.

So if you have a private network, but give a client/customer access to it, and they ask for the source, you will have the obligation to give it to them.