Today there seems to be no clear, easy way to restrict access to an Azure virtual network to only Business Central online. In an Azure Virtual Network, you can use virtual network service tags to allow or deny access to certain services. There are a number of Microsoft services that already provide these service tags, including Dynamics 365 for Marketing. I don't know if it's possible based on the architecture, but it if it is, it would be very nice to have Business Central in the list.