Do we need a Git clone? Can we use a tarball?

For consistency and simplicity yes, we need git clone but it will be bound to tag/versions all the time, using tarball makes it harder to maintain it because it has some submodules.

We can't avoid this right now, this requires upstream changes in the project and not sure if msquic is willing to do that.
FetchContent is only used to Fetch quictls here from submodules which is already fetched:
https://github.com/microsoft/msquic/blob/a09a6de23d724dc7cae9b5bf9dfb82205331a59a/CMakeLists.txt#L662-L678

Per CMake documentation:

If the dependency has already been populated earlier in this run, set the <lowercaseName>_POPULATED, <lowercaseName>_SOURCE_DIR, and <lowercaseName>_BINARY_DIR variables in the same way as a call to FetchContent_GetProperties(), then skip the remaining steps below and move on to the next dependency in the list.

https://cmake.org/cmake/help/latest/module/FetchContent.html#command:fetchcontent_makeavailable

Can we use this to avoid fetching submodules again?

Btw, note that I'm just a bystander and not a Homebrew maintainer, better ask @carlocab if this FetchContent thing is important for Homebrew

Can we use this to avoid fetching submodules again?

We definitely can, but not sure what will be the response from msquic to this, even if we can make it happen on main, it's highly unlikely that it's going to get backported to 2.4 release and make a new release for this.

No, I mean these variables can be set during CMake configuration step, without updating the sources

QUIC_TLS should be set, CMake interpreter goes in the if(QUIC_TLS STREQUAL "openssl" OR QUIC_TLS STREQUAL "openssl3") condition, but does not populate the submodule because of the variables you provided

You still need to provide QUIC_TLS, and CMake should stumble upon FetchContent, but consider it already populated

Theoretically

Theoretically yes, but after I set those variables as populated I still got the same error as

Refusing to populate dependency 'OpenSSLQuic' with FetchContent while
  building in Homebrew, please use a formula dependency or add a resource to
  the formula.

I don't know what brew maintainers will say, but I suggest leaving HOMEBREW_ALLOW_FETCHCONTENT=ON but still using <lowercaseName>_POPULATED variables, so FetchContent doesn't download anything

Looks like brew's trapper was not ready for this scenario

@carlocab what do you think?

I can do that, but here is what's actually happening (if I understood correctly) submodules are already getting downloaded as part of git submodules, and we're not downloading anything with FetchContent, what FetchContent doing is just building quictls and make it a usable library with add_library. See:
https://github.com/microsoft/msquic/blob/a09a6de23d724dc7cae9b5bf9dfb82205331a59a/submodules/CMakeLists.txt#L10

Also, setting those variables leaves us to compilation step of quictls as part of brew formula as well, unless there is a way to add dependency of quictls to brew formula and get binary/include paths for this purpose.

I've talked with msquic team, and they will be happy to accept improvements for next release, but we still need workaround for release/2.4.x.

I found similar case:

along with -DHOMEBREW_ALLOW_FETCHCONTENT=ON, should do what we want, if I understood correctly, it will block any download over FetchContent.