There are essentially two levels to this.  The first is an explicit
package designation, using : or :: to indicate the package in which a
symbol is supposed to be accessible.[1] That is used to find an
appropriately matching symbol (which may actually be in a different
package)[2] or to indicate in which package a new symbol is created.  If
there is no explicit package indicated, then the current value of
*package* is used

IN-PACKAGE is one way of setting the current package, which is kept in
the variable CL:*PACKAGE*.

   (defun huhu ()
     (list *bar* 'bar (read-from-string "foo::bar")))

By the way, the reason *bar* and 'bar are in the FOO package is because
that is the current package when this form is READ by the reader before
being passed on to the evaluator (or compiler).  Remember that it is the
reading process that determines in which package symbols in the code end
up.[3]  And since there was an (in-package :foo) before this code was
read, the current package was set to FOO.

So, explicit qualification works if you have a constant string to read.
If you want to process an arbitrary string in a particular package, you
can bind *package* to the package you want:

   (defun huhu ()
     (let ((*package* (find-package "FOO")))
       (list *bar* 'bar (read-from-string "bar"))))

=========== Notes ===========

[1] There is also #: to indicate to tell the reader to not intern the
symbol in a package at all.

[2] The package qualifier indicates the package in which the lookup of
an existing symbol occurs.  So if there is an explicitly or implicitly
imported symbol that matches, it will be returned even if it is in a
different package.  In that way  cl-user::car and cl:car are the same
symbol.

[3] OK, there are program calls like INTERN that can also do this, but
we aren't using them in this example.