You know, Ii depends on how secure you want your environment to be. For example, you can enable SCC option in your VNET injected workspace. When secure cluster connectivity is enabled, customer virtual networks have no open ports and compute resources in the classic compute plane have no public IP addresses.

Then, you can define user defined routes, apply them on databricks subnets and redirect all outbound traffic through azure firewall. 

But when you don't have specific requirements, you should just stick to the approach used by your organization.