SQL Server unable to whitelist subnet when public access is disabled?

### **This is autogenerated. Please review and update as needed.**

## Describe the bug
Right now when running `az sql server vnet-rule create` on a SQL Server which has `Deny Public Access` set to `yes`, you will get an error stating `BadRequestError: Unable to create or modify firewall rules when public network access for the server is disabled. `.

According to documentation this seems to be desired/expected behaviour, but if feels really weird. Why would I want to turn on public access before adding a subnet in my vnet to my SQL Server whitelist?

I would expect that I simply can add subnets to my whitelist on SQL Server which can connect through the private endpoint, but this doesn't seem the case. As far as I know, there is currently no possibility to do anything with NSG's on private endpoints. This would solve this challenge.

PS. I dont think this is an actual bug, but more very confusing behaviour.

**Command Name**
`az sql server vnet-rule create`

**Errors:**
```
BadRequestError: Unable to create or modify firewall rules when public network access for the server is disabled. (https://docs.microsoft.com/en-us/azure/azure-sql/database/connectivity-settings#deny-public-network-access)
```

## To Reproduce:
Steps to reproduce the behavior. Note that argument values have been redacted, as they may contain sensitive information.

- _Put any pre-requisite steps here..._
- `az sql server vnet-rule create --server {} --name {} --resource-group {} --subnet {}`

## Expected Behavior
Allow certain subnets to my SQL Server through the VNET and block everything else.

## Environment Summary
```
Windows-10-10.0.19041-SP0
Python 3.6.8
Installer: MSI

azure-cli 2.18.0

```
## Additional Context