getting updates via internet from DB subnet

Greetings,

I have a Database VM in a private subnet. 

What is the best policy setup to have the VM be able to get updates from the internet? 

Does it need to have it's own public ip?

On AWS I create an internet gateway and route traffic through that.

All I found on Azure is to use a third party VM Image like Barracuda which is over $1000/month.

I hope someone is able to point me in the right direction here. :-)

Thank you,

Chris