Azure CLI: associate network security group (NSG) with Virtual Network subnet

a) I have an existing virtual network named "my-network1"

b) This network has an existing subnet called "my-subnet1"

c) I want to create a new Network Security Group called "my-nsg1" with a rule that permits all traffic inbound on port 9999 to "my-subnet1"

Can someone please help with the list of Azure CLI "network" commands to acheive this? All the examples online are using powershell which I cannot use on my Mac. Also how can I see what NSG is associated with a given VNET/Subnet with the CLI?