Maybe I am missing the point, but "loose" dependencies go in setup.py, and "exact versions" go in requirements.txt.

https://caremad.io/posts/2013/07/setup-vs-requirement/