How to protect classes so they are not visible outside their package

Just leave out all keywords. The default visibility is package-private, viewable within the package only.

e.g.:

// class Foo is public
public class Foo
{
    final private Bar bar = ...;
}

// class Bar is package-private
// (visible to all classes in the package, not visible outside the package)
class Bar
{
    ...;
}