A U.S. federal government agency must deploy a workload that stores data subject to strict compliance requirements mandating physical and logical isolation from commercial Azure infrastructure, with access restricted to screened U.S. personnel. Which type of Azure region should the agency use?