only code that relies on Neos Features or extends them and cannot be used without is required to be GPL.
Also GPL does not require that you publish your code. You are only required to make the code accessible for the customers you give it to and allow them to change and republish it. Only when you publish the software to $anyone, $anyone becomes a customer that is granted the right to modify and republish.
If you build upon the Flow Framework you are extending MIT code which allows basically anything.
So putting the core your code into pure composer packages (that can be used in any php environment) is usually the way to go. Even if your core package relies on Flow Features like DI, AOP or ORM such packages can still be any license as the Flow(MIT) allows this. An adapter package that then connects such code to the CMS has to be GPL but this does not extend to the adapted package.
Dealing with licenses is always pita but if your legal department requires this you will have to do this anyways. With clean structure and a little planning i doubt the GPL is the real showstopper.
Side Note: What we really should consider is wether it makes sense to move Neos.Fusion and AFX to the Framework(MIT) side one day as currently those are GPL.