Thanks for the guidance @WiliamRosa
We do need --require_secure_transport=ON on the source side. 

Since the connection works fine from a Databricks notebook, I’m assuming there aren’t any outbound or inbound network restrictions or blocks.

Also I've verified (host, port, user, password) - no issues there. I don’t see any dedicated SSL options except that I tried appending flags in the hostname and checked the 'trust server certificate' option.