Disclosure: I run a small paid email service, so I've been on the receiving end of this.

Q1: Google doesn't really have a whitelisting step. You get in by having SPF, DKIM, DMARC and a clean reverse DNS, and then reputation does the rest. Google Postmaster Tools lets you see how they rate you, but you verify that via a DNS record, not a CAPTCHA.

Microsoft is the one with hoops. If your IP lands on their block list (and new or small senders land there easily, sometimes without any obvious reason), the only way out is their delisting form at sender.office.com. You enter the IP, confirm via email, solve a CAPTCHA, and wait. We had to do this for both of our sending IPs. No human involved, no explanation of why we were listed in the first place.

So yes: Microsoft makes small operators prove they're human. Google mostly just judges you silently.

Q2: Microsoft's outbound servers won't solve anything. If you put a CAPTCHA in front of them, their mail simply won't arrive, and nobody at Microsoft will notice or care. The only "hoop" that works in that direction is greylisting: big senders retry properly, so temporary rejections get through. Anything interactive just breaks the flow.

There's no reciprocity. The big providers set the rules, everyone else complies.

i would guess that publishing and adhering to mail security records (dmarc, dkim, spf) probably also helps.

I never had to do anything special besides standard Email security setup for any domain I run.

I don't go out of my way to send email to Gmail accounts.

But the requirements I've encountered from Gmail were just modern email server headers and such, as was already mentioned by sqw.