So, if you cover how proxy server authentication works from here:
You'd see that there are a couple of them which follow certain authorization types:
Here's a quick overview of what's in the link
Basic (see RFC 7617, base64-encoded credentials. See below for more information.),
Bearer (see RFC 6750, bearer tokens to access OAuth 2.0-protected resources),
Digest (see RFC 7616, only md5 hashing is supported in Firefox, see bug 472823 for SHA encryption support),
HOBA (see RFC 7486 (draft), HTTP Origin-Bound Authentication, digital-signature-based),
Mutual (see draft-ietf-httpauth-mutual),
AWS4-HMAC-SHA256 (see AWS docs).
So the config for authentication using Git over a proxy should be Basic which uses Plain-HTTP authentication so that's clear text, hence the purpose of Git using them non-encrypted.
I haven't seen any other use case for the other authentication schemes regarding Git in general. I'd really love to see an example but I haven't discovered such personally.
Since it's basic, then you'd just have to use it as such and update it over every password change cycle or use SSH to prevent using a password in the first place