A company is planning to migrate its infrastructure to Azure and requires a solution to segregate network traffic between its HR, Finance, and IT departments within a single virtual network to ensure security and compliance. Each department's resources must be isolated from one another to prevent unauthorized access, while still allowing for inter-departmental communication under strict controls. Given the need for cost-effectiveness and scalability, which Azure networking feature should be used to achieve this isolation, and why? (Choose one correct option.)