You can place your function app as part of application gateway backend pool. So that you there will flexibility of keeping application gateway in a VNET for using DDoS feature capabilities in mitigating external flooded traffic. Here is the architecture
for better understanding of the flow.

If you think your question has been answered click "Mark as Answer" if just helped click "Vote as helpful". This can be beneficial to other community members reading this forum thread.
________________________________________________________________________________
Best regards
Subhash