As written, this has worked for me although I'd be very interested in better, possibly more secure ways of doing this. To date, nothing has broken. 
If you have packages from AUR for example and wish to add them to your ISO image you can create a personal repository that includes just those packages.
https://wiki.archlinux.org/index.php/Pacman/Tips_and_tricks#Custom_local_repository
If you have only the PKGBUILD you'll need to build the package in that directory first.
makepkg -Acs
Collect all packages in the same directoy as the repository
mkdir -p /usr/share/repo
cd /usr/share/repo
cp /path/to/package.pkg.tar.xz ./
Create the repo database
repo-add repo.db.tar.gz *.pkg.tar.xz
Same syntax for adding additional packages to the same repo.
repo-add repo.db.tar.gz package-name.pkg.tar.xz
Add your repo to /usr/share/artools/pacman-default.conf
[repo]
SigLevel = Optional TrustAll
Server = file:///usr/share/repo/
This can be placed in your build directory also so it's available in live mode or even installed.
artools-workspace/iso-profiles/YOUR-PROFILE/live-overlay/usr/share/repo/
When you update the package cache in live or installed mode this repo is valid.