Yes the proxy always intercepts the traffic.
No it can't read the traffic if using the intended target's certificate.
Yes it can read the traffic if it spoofs the public key, but the browser will display a warning, so
No there is no way to intercept and read the traffic without generating a browser warning.
My explanation starts with this sentence:
The proxy creates a public key and sends it to the client and starts an encrypted connection.
That is not quite how it works. The proxy would have to send a fake certificate to the browser, which would include the public key but would also have to contain other information, such as the domain that owns the key. In addition, the whole certificate is digitally signed and therefore tamper-resistant. The signature can be verified by using the public key of the organization that issued the certificate. That public key is in turn verified by another SSL certificate, all the way up the chain, until you reach the CA. The CA certificate is installed as part of your operating system, so its public key is well-known.
So, unless the proxy has one of the private keys from the chain of trust, it is impossible for the proxy to provide the browser with a fake certificate or alternative public key without the browser knowing that it is fake-- it can't generate the signature.
If the proxy cannot provide a fake, there is no way to convince the browser that the public key and the domain name go together, and your browser will display a phishing warning, turning the address bar red.
Even if you are accessing a host via IP address, the certificate is still required, and the domain name on the certificate can still be seen by the end user. The browser will always turn the address bar red. Also, the end user can click a button on the browser to view the certificate and manually determine if the domain name is correct. If the domain name is suspicious, the user is supposed to close the browser and stop using that endpoint.