Service Endpoints and Securing Storage

You have been asked to create a proof of concept to demonstrate securing Azure file shares. Specifically, you want to:

Create a storage endpoint so traffic destined to Azure Storage always stays within the Azure backbone network.
Configure the storage endpoint so only resources from a specific subnet can access the storage.
Confirm that resources outside of the specific subnet cannot access the storage.