For API Portal 4.2, private API's are assigned to organizations via their Account Plan.
In the Account Plan you can select which Private API's are included, and then for organisation's that uses that account plan they can see the private API's.
There was an enhancement request, that covers adding some flexibility when adding private API's to groups, and how that affects the group's visibility :
API Portal 4.2 - better control over public/private visibility of API Groups
Cheers - Mark