Per local discussion, please enable the "upload by url" feature. Autoconfirmed user should be able to upload files from url in Special:upload, and they could only upload files inside upload.wikimedia.org. Configuration file can be seen below:
$wgGroupPermissions['autoconfirmed']['upload_by_url'] = true; $wgAllowCopyUploads = true; $wgCopyUploadsFromSpecialUpload = true; $wgCopyUploadsDomains = array( 'upload.wikimedia.org' );
Thanks for help.