How to block ports from public and allow ports within Vnet in Azure?

I've setup a site-to-point VPN in Azure. I want to allow ports 3389, 22, 5432, 8080 for users that logs in using the VPN client and at the same allow only port 8080 at the public IP for this VM. These configs can be done at the NSG How can I achieve this?

In the VM/Networking tab, I can see NSG attached to a subnet and another NSG attached to the NIC.

All you need is a rule allowing 8080 from the internet, the NSG default rule already allows communication on the virtualnetwork tag which includes VPN gateway routes