A response was previously sent to Erick via email, but we are posting the response here as well for the community to read:
Much of the synthetic data available in the sandbox environment may not have real NDC codes. However, we just updated the first 10,000 test users. We suggest using BBUser00000 through BBUser09999 for your testing as they are the closest to production data. These users should have accurate NDC but it isn’t guaranteed.
The Blue Button 2.0 API Team