what/where is the reference architecture for custom edge nva protecting private ip vm?

Question

consider this scenario https://learn.microsoft.com/en-us/azure/virtual-network/tutorial-create-route-table-portal

where i want to deploy my own linux nva configured as a waf to protect a wordpress site from owasp

am i correct in asasuming i need to deploy the nva as aat the edge with a public ip
and hide the protected resource by removing its public ip?
is this a valid setup?

in which case i need help understanding whetheer or not i can configure autmoatic routinng beetween the edge and the protected ressource

or if i need to define back end in my nva as required

so is such a config possible with pure nsg/route
or willl it be nva config dependent as well?

how to achieve this