Azure firewall vs Azure network security group

Solution 1:

Azure Firewall features https://docs.microsoft.com/en-us/azure/firewall/firewall-faq#what-capabilities-are-supported-in-azure-firewall

Azure Firewall vs NSG https://docs.microsoft.com/en-us/azure/firewall/firewall-faq#what-is-the-difference-between-network-security-groups-nsgs-and-azure-firewall

I use NSG to limit access within a vNET and Azure Firewall to limit access to a vNET from the outside. There are some good detailed explanation in the docs articles

Solution 2:

Azure security groups is a feature of VNet that describe firewall rules on the subnets in Azure.

Azure firewall is a product for your transit VNet to secure traffic to Azure, across subscriptions and VNets.

Look at the diagrams in the documentation and decide what meets your design.