I created an Azure Web App and an Azure Function as well as an Azure Key Vault. I created an `access policy` to only allow the system assigned identities from the Web App and Azure Function access to the Key Vault. But it still feels quite open if "All networks, including the internet" can reach the Key Vault. How can I simply limit the network access to my own Resource Groups? I was not able to find a how-to for this scenario.