Your organization has a single Virtual Private Cloud (VPC) network in Google Cloud, connected to your on-premises network via Cloud Interconnect. You need to restrict access solely to Google APIs and services supported by VPC Service Controls while maintaining hybrid connectivity with a guaranteed service level agreement (SLA). What is the correct configuration approach?