The correct answer is D (a service endpoint) because service endpoints provide secure, direct connectivity between an Azure virtual network and Azure services like Storage over the Azure backbone network, bypassing the public internet. This aligns with the question's goal of preventing internet routing. While A (NSG) can filter traffic, it does not inherently reroute traffic away from the internet; it only permits or denies traffic based on rules. B (public endpoint) would expose traffic to the internet, contradicting the requirement. C (VPN Gateway) is for connecting on-premises networks to Azure, not for internal Azure service routing. Community discussion supports D, with references to Microsoft documentation highlighting service endpoints as the optimal solution for this scenario.