`cloud-init` does not block VM provisioning
Solution 1:
All Cloud-Init is doing is running your commands once the VM is running, it does not block anyone from connecting to the machine while it is running and there isn't really a way to do that.
You could look at scripting something that disables RDP access on the NSG until the VM has completed provisioning.