Look where customers post, not where Instagram notifies you. The Tagged tab and your mentions hold the posts aimed at you, which is the smaller pile. The hashtag search and a plain text search of your brand and product name hold everything else, and for most consumer brands everything else is where the good material is.
The search order that finds the most
Start with the Tagged tab and mentions, because they take a minute and they are complete. Then run your brand name as a hashtag, then with the space removed, then your best-known product on its own. Someone posting a bottle of Graza on their counter is as likely to type the product as the company, and those are different searches returning different posts.
Then search the name as plain caption text. That last one is the step most brands skip and it reaches the posts that never used a hashtag at all, which on many accounts is the majority of them.
Save it when you see it
Hashtag results are ranked and truncated, so a post you scrolled past last week may not be reachable now. Save candidates to an Instagram collection the moment you find them. This sounds like housekeeping and it is the single habit that separates brands with a usable library from brands with a memory of a good post.
Ask before you use it
A public post is not a licence. The photograph belongs to the person who took it, and the fact that your product is in it does not transfer anything to you. Comment or DM, ask plainly, and keep the yes.
Reposting to your story with credit is the low-risk end and most people are pleased. Putting a customer's face in a paid ad without written permission is the end that produces letters. The gap between those two is worth more care than it usually gets, and asking costs one message.
What a library actually needs
A collection for candidates, a folder for the ones you have permission to use, and a note of who said yes and when. That is the whole system and it holds to a few hundred posts without any software.
The part it cannot fix is the post you never saw. Searching only works forwards, and it fails quietly: nothing tells you what was missed. If you want to see the volume a real brand produces before building any of this, the Poppi page is public and lists the posts themselves rather than a count.
One honest limit, which applies to us as much as to anyone. No text search reaches the post that shows your packaging and never names it. That photo is UGC in every sense except the one a search can find, and it is the reason the manual scroll through your own hashtag is still worth doing occasionally even after you automate the rest.