How to merge / combine two aar files?

Visibility wise, if you want to hide L1, just add it into your project using the "implementation" keyword. That way, it will not be leaked into the consumer's path. Now, that does not mean L1 gets instantaneously packed into L2. Regular binary files pack only their classes, and external classes are expected to be supplied from a repository. Therefore, you have two possible paths:

1.-Upload L1 and L2 to some sort of repository. Note that said repository does not need to be public, you can set your own repository and provide credentials to the users. This is the least painful path in a long term scenario.

2.-Create an uber aar/fat aar. There are several plugins you can use for that. For example this one, which is in active development. Or you can use the maven android plugin and create L2 using maven; in that case, any maven plugin for uber binaries should work. The maven android plugin is compatible with the gradle project format, so you only would need a POM file. Obviously, if you are using extra gradle plugins to build L2, this may not be feasible.

3.-Pack all the L1 classes inside L2 somehow. You may build the aar file manually, for example. The caveat with this, is that maintenance will become a nightmare. You would essentially be going back to an ANT-like scenario, and there are tons of reasons people avoids working with ant. If L1 changes, it will be painful. Also, the final file will not work, since you will need to also trace ALL transitive dependencies of L1 and add them to L2's path so they get imported. If for some chance, the people providing you with L1 did something similar, you are royally screwed.

4.-Provide both L1 and L2 files to the users, so they add them into their lib folders. In this case, even if L1 is being imported as "implementation", it will leak into the path, since pretty much everybody just imports the whole libs folder.

All things said, you need to pick your poison. My recommendation? Create a private repo (you can even use github for that). Is the least painful option, you can cut access to the users whenever you want, and if is necessary to handle custom builds for all of them, it can be done by just changing the artifactId/groupID. All the other paths have gotchas that will give you a hard time at some point.