1, You can create one NSG per subnet or single NIC and add multiple Security Rules to this NSG. 2, You can create one NSG with only one Security Rule (e.g. Inbound port 80) and then assigned multiple NSG to a Subnet or single Nic.