Even with a valid Maven mirror setup in ~/.m2/settings.xml, which works on the command line, Wireshark confirms that the IDE's online embedder downloads artifacts from the original server, not the mirror.
Background is bug #195190.
Bug #194916 is also of interest.
Seems to be working as expected in a dev build. With settings.xml specifying a local Nexus mirror, downloading dependencies of a project (or sources or Javadoc) makes no internet connection except when populating the Nexus cache.
Proxy settings also seem to be honored in a dev build. Replaced settings.xml with one which just declared the Oracle proxy and went on VPN. After deleting local artifacts, both command-line Maven build, and Download Declared Dependencies, went through the proxy server.
However, a different scenario: start the IDE with the system settings set to use a proxy; remove all config from settings.xml; and DDD. That does go through the proxy (and so succeeds). Not sure if this is a bug or a feature.
Fix of #202703 may have changed things; seems that settings.xml was being ignored for purposes of MavenEmbedder.resolve. Would really be nice to have this kind of thing be part of the test spec for Maven, since it is difficult to set up a sufficiently realistic test environment other than my own, and I have yet to get automated tests to cover Maven network operations.