A financial services company is migrating latency-sensitive trading applications to Microsoft Azure. Their compliance policy prohibits any application traffic from traversing the public internet, and they require a consistent, predictable SLA-backed bandwidth of 10 Gbps between their on-premises data center and Azure region. Which connectivity option should the network architect recommend?