Do we need to setup a site to site VPN?
Correct. More details regarding Azure VPN setup can be found here
Alternatively, you can connect your production and Azure environments, using Veeam PN for MS Azure
Also, do we need the Windows server VM in Azure + Veeam installed on that Windows VM
Azure Windows-based VM with repository role assigned to it will be needed.
or can we write directly to MS Azure storage as a repository?
Not possible at the moment.