If the dependency is not in the local m2 repository the white list feature should download it from where ever it can find it.

The solution would be to make a reusable dependency service from the service that checks valid GAV for new projects.