Hey @hs08 ,
Like @coolsport00 I don’t use tape nor am I familiar with Azure HCI, but unlike @coolsport00 I like your first solution a little better as it seems simpler than managing a Linux box and an Azure VM.
Depending upon your environment size run VBR on the bare metal server and use either internal, or some type of DAS or iSCSI for local storage. To obtain immutability on this local storage look into Blocky for Veeam https://blockyforveeam.com/ as this eliminates the need for a second Linux box for immutability.
Have another secondary backup to tape run off the bare metal server (just make sure you purchase a server with enough performance) and finally to cover our 3-2-1-1 rule send another secondary backup copy to some type of inexpensive cloud storage. Since you already are into Azure maybe a blob storage account there?
Granted, this is sort of an eggs in one basket approach, and if your VBR bare metal server is compromised or has a hardware failure (very rare these days IMHO) you probably won’t be happy.
On the other hand it is simple, very effective, and covers all the bases.
Just make sure your VBR configuration is backup up daily in multiple, easily accessible locations.
This may have been written before my morning coffee in my defense 😀