We are planning a backup solution for our customer. Their VM workloads are hosted on Azure VMware Service (AVS) within the Azure network. We propose using Veeam Backup and Replication (VBR) for their backup needs.
The short-term retention backups (30 days) will be stored to VDC Vault, while the long-term retention backups (12 months and 7 years) will be managed by Veeam backup copy jobs.
The long-term retention data will be stored on a Hardened Linux XFS repository located on the customer's on-premises network.
For backup and restore operations between AVS and VDC Vault, there will be no egress charges.
However, for backup copy jobs, if data from the VDC Vault traverses the internal ExpressRoute network to reach the on-premises infrastructure, egress charges will apply — which we aim to avoid.

I would like to confirm the following assumptions regarding the configuration of "Direct" connection mode when adding the VDC Vault repository to the VBR infrastructure:
1. For backup and restore operations between AVS and VDC Vault, I assume the VMware proxy will act as both source and target data mover, directly reading/writing data to/from VDC Vault over a direct internet connection?
2. For backup copy operations from VDC Vault to the Hardened Linux repository on-premises, not sure if the Linux repository will act as the source data mover, reading backup data directly from VDC Vault over a direct internet connection and writing data on it's XFS file system?

Thank you in advance for your support.
Best regards,
John