How to put multiple VMs behind a single private IP address on Azure?

Question

I'm working on creating a Blue/Green deployment for a product in Azure but I'm running into a problem regarding outbound traffic to an on-premisses database.

Our initial idea can be seen in this diagram:

We have three main "moving parts":

A spoke subscription with a VNET and the VMs running different versions of our product

A hub subscription and network with a VPN Gateway

An on-premisses network with a DB and a client

Our production VMs need to be accessible to the on-premisses client at a fixed IP, but also be able to access the DB (which the on-premisses Firewall allows only a single IP).

This worked very nicely with a single VM, but now that we want to do a Blue/Green deployment, things are getting a bit complicated.

The inbound part is very easy with a Load Balancer, but the outbound part (from the server to the on-premisses VM at a fixed private IP) is proving to be way harder than expected. It is specially necessary that the on-premisses network sees a single private IP as the on-premisses firewall only allows this single IP to access the DB.

I saw a lot of similar questions, but all of them focused on public IP, instead of private IP, which is what I really need.

My initial idea was to use NAT Gateway or Internal Load Balancer with outbound traffic, but they both use public IPs, and we need it to be fully private.

Using Azure Firewall and "forcing" SNAT does translate the IP address to another internal IP, but it uses a pool of internal IPs instead of a fixed one, so that doesn't work either.

Any suggestions?