This is a massive pain at my work, same as I'm sure most other comments are saying.
I use Platform.IO for firmware development and can't build my firmware unless I hotspot my phone. I would say that's a PIO bug unless there is a flag I don't know about, but it's exposed by this nuisance of a firewall.
The devs where I am spend much of our time hotspotted to our phones with the corporate network never connected so IP goes out over the mobile network.
Whenever possible we use 'do not verify server certs' flags in libs and commands which is not ideal.