Lots of creatives have a password-protected part of their portfolio – they share that password with a select few studios with the caveat that it’s under NDA. Of course, there’s still some risk associated with that method. The best scenario is waiting to talk through that work in an interview setting. Show them, but don’t send them a copy. Basically, avoid a digital paper trail.
Adding a list of client names or logos is another workaround. It means you can demonstrate the type of work you’re doing without breaching contracts. If you have ever seen Apple listed on a portfolio, they’re doing exactly that. Apple are a client notorious for iron-clad contracts stopping creatives from showing work (but everyone wants to shout about the fact they’ve worked with them).
You absolutely can include passion projects. I’d encourage it. They are the projects that demonstrate your skills better than client work. It shows your creativity without constraints of a brief, with every decision made by you.
If you have junior projects that could use an update, then do it. There’s no shame in saying you’ve included those to give a flavour of your experience (even if they are outdated) and would love to share other projects that aren’t ready to be released.
Don’t be afraid to show your full portfolio – just ensure it’s to the right people and you keep complete control of who has access to it.