Comment 91 for bug 1835296

There are some hardcoded code model paths in the ngspice.cpp file (see NGSPICE::findCmPath on line 438) that it will search through. These seem to be the paths it will look at to find spice2poly.cm (if that file exists, it says it found the code model paths).
    const vector<string> cmPaths =
    {
#ifdef __WXMAC__
        "/Applications/ngspice/lib/ngspice",
        "Contents/Frameworks",
        wxStandardPaths::Get().GetPluginsDir() + "/sim/ngspice",
        wxFileName( wxStandardPaths::Get().GetExecutablePath() ).GetPath() + "/../../../../../Contents/PlugIns/sim/ngspice"
#endif /* __WXMAC__ */
        "../lib/ngspice",
        "../../lib/ngspice"
        "lib/ngspice",
        "ngspice"
    };

From my reading of the code, you can override these paths by specifying a spiceinit file that lives on one of the (relative) searched paths:
    const vector<string> spiceinitPaths =
    {
        ".",
#ifdef __WXMAC__
        stdPaths.GetPluginsDir() + "/sim/ngspice/scripts",
        wxFileName( stdPaths.GetExecutablePath() ).GetPath() + "/../../../../../Contents/PlugIns/sim/ngspice/scripts"
#endif /* __WXMAC__ */
        "../share/kicad",
        "../share",
        "../../share/kicad",
        "../../share"
    };

Eeschema will send the code model commands if it didn't find a spiceinit file and if it was able to find the code model path.