I have a tool who's core function is in a private module. It works fine in studio but returns the error: 'require(assetId) cannot be called in client'.
There's not any practical way to do it. If a LocalScript has to access it, there's not a chance of it working because any code loaded to the client could be stolen anyway. If the code can be stolen, it's counterintuitive for it to be private.
Your best bet is to have all major logic handled by the server (Which should happen anyway) and any bridging event logic happening on the client. As it should be done.