Just following up on this. We put the metastore in an existing storage account attached to the primary workspace. We're setup with with vnet injection so it did require allowing the primary workspace vnet permission to the others. It's been working great, no complaints about this configuration so far.