Networks in Azure are known as virtual networks. A virtual network can have multiple IP address spaces and multiple subnets. Azure automatically routes traffic between different subnets within a virtual network.
The question states that FinServer must be on a separate network segment. The only way to separate FinServer from the other servers in networking terms is to place the server in a different virtual network to the other servers.
Reference:
https://docs.microsoft.com/en-us/azure/virtual-network/virtual-network-vnet-plan-design-arm

Reference:
https://docs.microsoft.com/en-us/azure/governance/policy/overview

The Premier support plan provides customer specific architectural support such as design reviews, performance tuning, configuration and implementation assistance delivered by Microsoft Azure technical specialists.
Reference:
https://azure.microsoft.com/en-gb/support/plans/

Authentication, not authorization is the process of verifying a user's credentials.
The difference between authentication and authorization is:
Authentication is proving your identity, proving that you are who you say you are. The most common example of this is logging in to a system by providing credentials such as a username and password.
Authorization is what you're allowed to do once you've been authenticated. For example, what resources you're allowed to access and what you can do with those resources.