Generally speaking, users and administrators have two options:
(1) Let Firefox continue to use its own certificate store, and manually import the proxy server's signing certificate into Firefox as a valid authority so that the fake certificates are treated as genuine.
For the end user, there are multiple steps that aren't well documented.* For administrators, there is a Group Policy option, but I don't know how easy it is to deploy (https://github.com/mozilla/policy-templates#certificates--install).
* Example support thread: https://support.mozilla.org/en-US/questions/1199797#answer-1064849
(2) Switch Firefox to using the system certificate store.
There is a preference for this in about:config (security.enterprise_roots.enabled) and a Group Policy (https://github.com/mozilla/policy-templates#certificates--importenterpriseroots)
Some consumer security software (e.g., Avast) inserts a policy to reduce support issues. Of course, when users see on their Settings page that their organization is controlling some of their settings, it becomes a support issue for Mozilla...
