Azure VM - Block access to internet but not to studio.azureml.net

I want to be able to block access to the internet but allow studio.azureml.net. What are my options?

I'm trying to achieve this using a NSG where I block internet access and allow a Service Tag but that doesn't seem to work.