SQL MI firewall

During SQL MI deployment, a built-in firewall is deployed along with a dedicated virtual network (VNET). We can choose to access SQL MI using either a public URL or a private endpoint. Does this built-in firewall provide sufficient protection for SQL MI, or do we need to implement an additional firewall?