Blocking Outbound Internet connection on Azure VM but keeping Antimalware Extension working -

i have vm on blocked outbound connectivity internet using networksecuritygroup.

i installed antimalware extension , realized installation not work without connecting internet. removed networksecuritygroup reactivate outbound connectivity , installed correctly.

now want put networksecuritygroup restrictions (no internet access).

what exclusions should add networksecuritygroup antimalware extension continue working , update normally?