After doing a sucessfull "apt update":

Package 'base-files':

Currently installed:
$ aptitude --disable-columns search '?exact-name(base-files)?installed' -F '%?v'

9.4ubuntu4.5


But no "9.4ubuntu4.5" within local list data:

$ apt-cache showsrc base-files | grep '^Architecture: |^Binary: |^Directory: |^Maintainer: |^Version: '

Binary: base-files
Version: 9.4ubuntu4.4+p16.04+git20170527.1856
Maintainer: Neon CI <neon@kde.org>
Architecture: any
Directory: pool/main/b/base-files

Binary: base-files
Version: 9.4ubuntu4.4+p16.04+git20170210.1607
Maintainer: Ubuntu Developers <ubuntu-devel-discuss@lists.ubuntu.com>
Architecture: any
Directory: pool/main/b/base-files

After checking "sources.list", I had to manually (re?-)activate
all the 'deb-src' lines. Now, it looks fine, again:

$ apt-cache showsrc base-files | grep '^Architecture: |^Binary: |^Directory: |^Maintainer: |^Version: '

Binary: base-files, lsb-release-udeb
Version: 9.4ubuntu4
Maintainer: Ubuntu Developers <ubuntu-devel-discuss@lists.ubuntu.com>
Architecture: any all
Directory: pool/main/b/base-files

Binary: base-files, lsb-release-udeb
Version: 9.4ubuntu4.5
Maintainer: Ubuntu Developers <ubuntu-devel-discuss@lists.ubuntu.com>
Architecture: any all
Directory: pool/main/b/base-files

Binary: base-files
Version: 9.4ubuntu4.4+p16.04+git20170527.1856
Maintainer: Neon CI <neon@kde.org>
Architecture: any
Directory: pool/main/b/base-files

Binary: base-files
Version: 9.4ubuntu4.4+p16.04+git20170210.1607
Maintainer: Ubuntu Developers <ubuntu-devel-discuss@lists.ubuntu.com>
Architecture: any
Directory: pool/main/b/base-files

I think, it's bad practice to have two
'base-files' packages ('Ubuntu' and 'neon').

Rename the KDE Neon Version, and
make it providing 'base'.

Edit:
… and make it to provide:
1.) 'base' (pure virtual)
and
2.) 'base-files' (mixed virtual)

In the KDE Neon Installer, You have to
enable all "deb-src" Entries:
Not only those in
/etc/apt/sources.list.d/neon.list
but also those in
/etc/apt/sources.list

If You don't, Your users
will get inconsistent query results by default.

The reason being:
Some identically named packages are available
from Ubuntu and neon.
Therefore, the configuration of both sources
has to be identical.

The thing I understand least of all:

Why did You - from the beginning -
call KDE Neon's archive 'xenial' - like Ubuntu
calls theirs?

It would be easier, if You would call it
'xenialneon' or similar.

All You get by calling it 'xenial' is:

Namespace pollution and possible
sources for future trouble.

Edit:
As far as I can see, You could do it now.
It's not too late. You only need
a new symbolic link on Your server and
a new entry in the user's 'neon.list'

Seems easy to me. Maybe, I'm wrong.