An Azure networking service that is used to provision private networks and optionally to connect to on-premises datacenters.
You can deploy a VNET and run SQL VMs in it. Your VNET needs a Gateway Subnet to connect from On-Premises. Since you mentioned you need private access to the SQL design depends on what kind of SQL service you choose. For IaaS based SQL, you can simply deploy a VM without public IP and connect using private IP from On-Premises. For PaaS based SQL deployment, you can deploy Private Endpoint and connect from On-Premises.
Let me know if you have any questions.
Regards,
Karthik Srinivas