With Azure Bastion, you can secure and seamless RDP and SSH access to your virtual machines over SSL from the Azure portal and without exposing public IP addresses. You just need to prepare your application as usual then you can SSH access to your VM and access the application from the Azure portal with the localhost address. It looks like that you can access the application within a VNet.
For example, I have a windows VM without public Ip but enable IIS and there is a static website. I can access the website with URL http://localhost/
or http://<privateIpaddressofVM>
.

Azure Bastion uses an HTML5 based web client that is automatically
streamed to your local device so that you get your RDP/SSH session
over TLS on port 443 enabling you to traverse corporate firewalls
securely.
Read Azure Bastion for more details.