For open source material such as the Financial Force libraries, it is common to simply lift the source and add it into your DX project for your own managed package.
Obviously you are then taking a snapshot of the library at a given date and time, so later changes to the library have to be manually incorporated into your package as and when required.
My recommendation is to ensure that you put all the code for a given open source library into an alternative source path, though within the package directory used for your managed package.
For example, if you have the standard
force-app/main/default as the folder you use for your own managed package, consider putting the ffhttp-core library in folder
force-app/opensource/ffhttpcode for example.
When you have a dependency on an actual package obtained through the App Exchange, for example, you have no choice but to have the customer first install that dependency then install your package.