Your company runs a data-processing application on virtual machines in the subnet 'app-subnet' within the VNet 'prod-vnet'. The application must access an Azure Storage account, but the security team requires that the storage account only accept traffic from this specific subnet while blocking access from the public internet. Cross-region access is not required, and you want to avoid the cost and management overhead of provisioning private endpoints. What should you configure to meet these requirements?