I think Gabriel's blogpost http://www.haskellforall.com/2018/08/nixos-in-production.html he explains how to work around nixos-rebuild's inflexibilities. However, I think everything that is being suggested is actually possible in nixos-rebuild already
They blog is still a good exercise to understanding what nixos-rebuild does behind the scenes though.
Deploy to a target machine, from a build machine, with pinned nixpkgs, and a specific nixos config:
nixos-rebuild switch \
--build-host=build@build.service.consul \
--target-host=root@node1.node.consul \
-I nixos-config=./configs/node1.nix nixpkgs=https://github.com/NixOS/nixpkgs/archive/b74b1cdb2fecc31ff7a127c5bc89771f887c93bb.tar.gz