@Assaf Katz , You should be able to achieve this using Azure Firewall alone architecture model.
Hosting your VM's behind the AZ-Firewall provides SNAT at Firewall. Now you can whitelist the Firewall PIP alone in your Bitbucket server as the source IP will always be AzFwPIP.
----------
Please do not forget to "Accept the answer" wherever the information provided helps you to help others in the community.