You stated that your local network restrictions are a contributing factor.
Are you able to make this work outside of your network? For instance, if you have a laptop with Tableau Desktop on it and you take it outside your network and get your LAN out of the equation, do you still get a failure?
I tried to do a minor replication of this just by trying to connect to GA from Tableau desktop (10.5) account, which I've never done before. I received the same error you received and it seemed to me that error was coming from GA and not Tableau. I then realized I didn't even have an analytics link to my Google account so I created one. I tried again to connect to GA through Tableau and it worked fine this time. This makes me wonder if there's something "broken" with the link to whatever account you're using and GA.
You may have covered these bases, but I thought I'd throw in my experience to see if it helps in any way.
Correct, if I took Tableau Desktop and ran this out of our corporate network, it would function perfectly fine. The issue then is it cannot be published to our internal Tableau Server. Granted, you could create an extract while not on our network and then publish that extract, however the server fails to authenticate as well. We would need to repeat this process every day to keep the data refreshed.
I'm not a fan of this "solution" but does it work if you change your default browser to IE ? I have the same problem and this works.