Our solution was to create a standard init.gradle script at the corporate level that injects a pluginManagment block into every settings.gradle. This code maps projects to both
plugins.gradle.org (including doing the funky metadata mapping from the undocumented rest service) and our internal plugin repositories. As a side effect we added a global mapping file that is downloaded and cached that maps symbolic version names (e.g. CURRENT, TEST, etc.) to centrally defined versions. We also remap all external repositories for both plugins and projects to our approved internal mirrors. We were able to do this once and projects don't need to have a pluginManagment block defined in them.