Private docker registry that attempts a pull-through on images not found locally
Yes, it is possible. The entire subject is discussed in Registry as a pull through cache, from where the below quotes are taken. 

Basically you need to configure the cache as a proxy for Docker Hub:


  Configure the cache
  
  To configure a Registry to run as a pull through cache, the addition
  of a proxy section is required to the config file.
  
  In order to access private images on the Docker Hub, a username and
  password can be supplied.

proxy:
  remoteurl: https://registry-1.docker.io
  username: [username]
  password: [password]



Of course, you also need to configure your docker daemon to use your local cache (but I presume that may be already done from the context of the question):


  Configure the Docker daemon
  
  Either pass the --registry-mirror option when starting dockerd
  manually, or edit /etc/docker/daemon.json and add the
  registry-mirrors key and value, to make the change persistent.

{
  "registry-mirrors": ["https://&lt;my-docker-mirror-host&gt;"]
}