[ARO] Locking down OSDisks to be only accessible to local network (rather than public)

ARO customers require VM's disk configuration where the disks are setup for public access as private. 

When selecting VM type when creating the cluster, the disks that are created for each ARO node's VM have their networking configuration set as 'Enable public access from all networks'. 
- For Example, say Resource: Disk x-xxx-xxx-xxxx-xx-xxxx-master-0_OSDisk which is controlled by VM abcdefghijklmnop-master-0 is set to public but customers need it to be private and have no way to do that. 

Security necessity and policies enforced by organizations

What is the design reason the disks for the ARO VMs are set to public access when deploying a private cluster https://learn.microsoft.com/en-us/azure/openshift/howto-create-private-cluster-4x?