Securing a network between a website and VM in azure

I understand that in windows azure you can add VMs to a virtual network, but I don't see the option to add a website to a network.

what is the recommended way of securing access to a VM (MongoDb) from an azure website?

I would much prefer have the db behind some sort of firewall rather than traffic going through the public internet.

Edit: the vm will be hosting MongoDb, so using Sql Azure or other MSSql solutions isn't an option.