Application security groups enable you to configure network security as a natural extension of an application's structure, allowing you to group virtual machines and define network security policies based on those groups.
You can filter network traffic inbound to and outbound from a virtual network subnet with a network security group.
Reference:
https://docs.microsoft.com/en-us/azure/virtual-network/tutorial-filter-network-traffic