Puppeteer starts Chrome with --proxy-server=http://IP:20001. Since Chrome does not take a password as an argument, authentication goes in page.authenticate({username, password}) before opening the destination.
SOCKS5
For SOCKS5 the argument changes to socks5://IP:20481. Authentication stays in the same method.
Call authenticate on every new page. A popup opened without it goes through the address and gets a 407.