A proxy in Nexus A, which points to a proxy repo on Nexus B. The proxy on Nexus B has firewall enabled with quarantine.
When a request comes in, for a component that has been quarantined, Nexus B will return a 403, but the proxy in Nexus A will then return a 404.
Expectation is that Nexus A proxy should also return a 403, so that it is clear why the build failed to the end developer.
Many customers will use a layered approach with Nexus instances, where Nexus instance used by builds do not have direct access to outside internet and firewall is enabled on the Nexus instance that does have outside access.