Explanation
A public internet user can reach the SAP Web-Dispatcher over port 443
The SAP Web-Dispatcher can reach the SAP Application server over port 443 The App Subnet accepts traffic on port 443 from 10.0.0.0/24 The SAP Application server sends traffic on port 30015 to the SAP DB server The DB subnet accepts traffic on port 30015 from 10.0.1.0/24.
Public Internet Access is blocked on both App Subnet and DB Subnet.

References:
https://azure.microsoft.com/en-in/blog/sap-on-azure-architecture-designing-for-security/