Azure ASE v2 - restrict network access for app services

I have an ILB ASE v2 with WAF (public IP). The ASE has its subnet where all web apps reside. For obvious security reasons I think I need to lock down access from Internet and leave only HTTPS open. But when I do that I can't see app services info in the portal. So what should my NSG look like for this subnet?

Also, WAF has its own subnet. It doesn't have NSG assigned either. Should it have one?

Here's the resulting rules set for ASE subnet NSG:

you might want to add HTTP to it if you need it.