Contoso manages 60 VNets across multiple subscriptions using Azure Virtual Network Manager. The security team requires that inbound traffic on TCP port 3389 (RDP) from the internet be blocked on all VNets, and this block must take precedence over any network security group rules that individual application teams might create. The teams must still be free to manage their own NSGs for all other traffic. What should you implement in Azure Virtual Network Manager?