Hello @Mohammed Thahif BK ,
Thanks for reaching out to Microsoft QnA. Happy to answer your question.
Yes, as far as I know, azure extensions are indeed supported on NVAs because ultimately NVAs are also VMs.
Regarding your second question, yes for the extensions to work properly, the VM agent should be reachable (which means the VM agent should be in 'Ready' state). This can only be possible if the outbound connectivity to the VM agent is open. So, you have to allow outbound connectivity to Microsoft owned IP address - 188.8.131.52. This IP is often referred to as the wire server IP.
Please refer to this document for additional information- what-is-ip-address-168-63-129-16.
I hope this helps. For any queries, feel free to reach back.
accept as answer and
upvote if the information provided is helpful.