Can I use route tables in Azure hub-and-spoke topology to route outbound HTTP requests to go through hub's NAT Gateway?

I have a hub and spoke topology in Azure so that spoke vnets are peered to hub. I have function apps running in spoke vnets and I'd like to route outbound connections from those through the hub's NAT Gateway so that all traffic would get one IP address for the HTTP requests.

Question: Is this possible with route table rules or do I need some network virtual appliance (NVA) to hub vnet to work as a "proxy"? ..or if NVA is mandatory for this to work, then what could be the cheapest option (small VM? load balancer?)

Microsoft does have this example for hub-and-spoke but it has simple VM as a NVA there: https://learn.microsoft.com/en-us/azure/nat-gateway/tutorial-hub-spoke-route-nat

I'd like to keep cost as small as possible so looking for ways to avoid setting up a VM for that purpose.

I have tried various azurerm_route rules but feels that it would need to be VirtualAppliance next_hop_type but then I'd need (private?) IP address of NAT gateway which doesn't have any.

resource "azurerm_route" "example" {
  name                   = "from_spoke_to_hub_nat_gw"
  resource_group_name    = azurerm_resource_group.example.name
  route_table_name       = azurerm_route_table.example.name
  address_prefix         = "0.0.0.0/0"
  next_hop_type          = "VirtualAppliance"
  next_hop_in_ip_address = ?
}

You can check the Azure Marketplace for the cheapest and easiest NVA.

Alternatively, you can use any method below for your requirement.

Method: 1

You can deploy a second NAT Gateway in the spoke subnet and use an IP from Public IP address prefix which gives you a contiguous range of Public IPs (which you can easily whitelist)

Method : 2

You can use Azure Firewall as a NVA in Hub , Follow the Integrate NAT gateway with Azure Firewall in a hub and spoke network for outbound connectivity for more details