An Azure networking service that is used to provision private networks and optionally to connect to on-premises datacenters.
For an Azure VM, you can create a network security group and associate it with the NIC of your virtual machine. With an NSG, you can create a deny rule for TCP port 3389 (RDP) and then create an allow rule and only allow the source IP address of your springboard VM. This will block any other VMs on the virtual network from accessing via RDP.
Here's some guides to help you with this:
https://learn.microsoft.com/en-us/azure/virtual-network/network-security-groups-overview
https://learn.microsoft.com/en-us/azure/virtual-network/tutorial-filter-network-traffic