A retail company hosts a fleet of backend processing VMs in a private subnet within a Google Cloud VPC. These VMs have no external IP addresses but must initiate outbound calls to a third-party payment API over the public internet. The security team mandates that no inbound internet connections be permitted to these VMs. Which Google Cloud service should the network architect deploy to meet these requirements?