If I understand correctly, you’re using HTTP basic authentication over HTTPS to allow only particular developers to access the repository. In that case, you can commit a .gitmodules that looks like:

[submodule foo]
  path = sub/foo
  url = https://example.com/git/foo.git

… i.e. without a user name, and then tell each developer to put their username and password in their ~/.netrc file. (If you’re using Windows, then there is some good advice on that here.) A simple .netrc file might look like:

machine example.com
  login myusername
  password areamandyingtotellsomeonehiscoolpassword

Update: An alternative, which doesn’t involve using .netrc, would be the following:

Again, remove the user name from the URL in .gitmodules and commit and push that change. When someone clones the repository they would first run:

git submodule init

… which will set the config option submodule.sub/foo.url to the URL in .gitmodules. However, the init step won’t clone the submodule into place until you do git submodule update, so you can do:

git config submodule.sub/foo.url https://myuser:mypass@example.com/git/foo.git

… and then:

git submodule update

To clone the submodules with the right user name. Note that then your username and password for HTTP authentication will be stored in your git config.