You can filter network traffic to and from Azure resources in an Azure virtual network with a network security group. A network security group contains security rules that allow or deny inbound network traffic to, or outbound network traffic from, several types of Azure resources.
You can use a site-to-site VPN to connect your on-premises network to an Azure virtual network. Users on your on-premises network connect by using the RDP or SSH protocol over the site-to-site VPN connection. You don't have to allow direct RDP or SSH access over the internet. And this can be achieved by configuring a deny rule in a network security group (NSG) that is linked to Subnet1 for RDP / SSH protocol coming from internet.
Modify the address space of Subnet1 : Incorrect choice
Modifying the address space of Subnet1 will have no impact on RDP traffic flow to the virtual network.
Modify the address space of the local network gateway : Incorrect choice Modifying the address space of the local network gateway will have no impact on RDP traffic flow to the virtual network.
Remove the public IP addresses from the virtual machines : Incorrect choice If you remove the public IP addresses from the virtual machines, none of the applications be accessible publicly by the Internet users.
Reference:
https://docs.microsoft.com/en-us/azure/virtual-network/security-overview
https://docs.microsoft.com/en-us/azure/security/fundamentals/network-best-practices

The default port for RDP is TCP port 3389 not UDP.
NSGs deny all inbound traffic except from virtual network or load balancers. For inbound traffic, Azure processes the rules in a network security group associated to a subnet first, and then the rules in a network security group associated to the network interface.
By default NSG rule to allow traffic through RDP port 3389 is not created automatically during the creation of VM , unless you change the setting during creation.
Here in the solution UDP traffic is allowed at virtual network level which is not tcp/rdp protocol. So this will not work to achieve the goal.
Reference:
https://docs.microsoft.com/en-us/azure/virtual-machines/troubleshooting/troubleshoot-rdp-connection
https://docs.microsoft.com/en-us/azure/virtual-network/security-overview#default-security-rules

A Backend Pool configured by IP address has the following limitations:
Standard load balancer only
Reference:
https://docs.microsoft.com/en-us/azure/load-balancer/backend-pool-management You can only attach virtual machines in the same region and that have a standard SKU public IP configuration or no public IP configuration. All IP configurations must be on the same virtual network.

Run the az acr build command : Correct Choice
az acr build command queues a quick build, providing streaming logs for an Azure Container Registry az acr build --registry
[--agent-pool]
[--auth-mode {Default, None}]
[--build-arg]
[--file]
[--image]
[--no-format]
[--no-logs]
[--no-push]
[--no-wait]
[--platform]
[--resource-group]
[--secret-build-arg]
[--subscription]
[--target]
[--timeout]
[<SOURCE_LOCATION>]
Create a host pool on Cluster1 : Incorrect Choice
Host pools are a collection of one or more identical virtual machines (VMs) within Windows Virtual Desktop environments. It won't deploy the app to the cluster.
Run the docker push command : Incorrect Choice
Use docker push to share your images to the Docker Hub registry or to a self-hosted one. It won't deploy the app to the cluster.
Run the docker build command : Incorrect Choice
This command will build an image from a Dockerfile. But in the question it has been said that image file is already built and need to deploy. This command will not deploy the image.
Reference:
https://docs.microsoft.com/en-us/cli/azure/acr?view=azure-cli-latest#az-acr-build
https://docs.docker.com/engine/reference/commandline/push/
https://docs.microsoft.com/en-us/azure/virtual-desktop/create-host-pools-azure-marketplace
https://docs.docker.com/engine/reference/commandline/build/