You can consider using Azure JIT (Just In Time) to secure your VM workloads, so that the ports will be open for a specified time and the auto disabled accordingly.
Reference # https://learn.microsoft.com/en-us/azure/defender-for-cloud/just-in-time-access-usage?tabs=jit-config-asc%2Cjit-request-asc#enable-jit-vm-access-
for creating the VM's and deleting them, you can depend on Powershell scripts or ARM templets.
Please 'Accept as answer' if the provided information is helpful, so that it can help others in the community looking for help on similar topics.