`cloud-init` does not block VM provisioning

Solution 1:

All Cloud-Init is doing is running your commands once the VM is running, it does not block anyone from connecting to the machine while it is running and there isn't really a way to do that.

You could look at scripting something that disables RDP access on the NSG until the VM has completed provisioning.