Azure Policy "SSH access from the Internet should be blocked" with effect deny

My goal: Prevent VMs being accessed via SSH by denying NSG rules which allow inbound traffic via the port 22.

I first tried to write a custom policy by myself and then to re-write this policy: SSH access from the Internet should be blocked. But in both cases, when I create a VM, the associated NSG will still be created with open SSH port.

My policies act like they have the effect audit, since they do not immediately stop the request of the resource (VM, NSG) but non-compliance in the Compliance is displayed later in the Portal. But then, of course, it is too late, and the resources are already in place and running.

Thanks for your help!

Update:

Rephrasing the question: Why does Azure not provide the effect deny in the first place?

The entire policy (same as the policy linked above, except the effect deny) as requested by @KenWMSFT:

"if": {
        "allOf": [
          {
            "equals": "Microsoft.Network/networkSecurityGroups/securityRules",
            "field": "type"
          },
          {
            "allOf": [
              {
                "equals": "Allow",
                "field": "Microsoft.Network/networkSecurityGroups/securityRules/access"
              },
              {
                "equals": "Inbound",
                "field": "Microsoft.Network/networkSecurityGroups/securityRules/direction"
              },
              {
                "anyOf": [
                  {
                    "equals": "*",
                    "field": "Microsoft.Network/networkSecurityGroups/securityRules/destinationPortRange"
                  },
                  {
                    "equals": "22",
                    "field": "Microsoft.Network/networkSecurityGroups/securityRules/destinationPortRange"
                  },
                  {
                    "equals": "true",
                    "value": "[if(and(not(empty(field('Microsoft.Network/networkSecurityGroups/securityRules/destinationPortRange'))), contains(field('Microsoft.Network/networkSecurityGroups/securityRules/destinationPortRange'),'-')), and(lessOrEquals(int(first(split(field('Microsoft.Network/networkSecurityGroups/securityRules/destinationPortRange'), '-'))),22),greaterOrEquals(int(last(split(field('Microsoft.Network/networkSecurityGroups/securityRules/destinationPortRange'), '-'))),22)), 'false')]"
                  },
                  {
                    "count": {
                      "field": "Microsoft.Network/networkSecurityGroups/securityRules/destinationPortRanges[*]",
                      "where": {
                        "equals": "true",
                        "value": "[if(and(not(empty(first(field('Microsoft.Network/networkSecurityGroups/securityRules/destinationPortRanges[*]')))), contains(first(field('Microsoft.Network/networkSecurityGroups/securityRules/destinationPortRanges[*]')),'-')), and(lessOrEquals(int(first(split(first(field('Microsoft.Network/networkSecurityGroups/securityRules/destinationPortRanges[*]')), '-'))),22),greaterOrEquals(int(last(split(first(field('Microsoft.Network/networkSecurityGroups/securityRules/destinationPortRanges[*]')), '-'))),22)) , 'false')]"
                      }
                    },
                    "greater": 0
                  },
                  {
                    "not": {
                      "field": "Microsoft.Network/networkSecurityGroups/securityRules/destinationPortRanges[*]",
                      "notEquals": "*"
                    }
                  },
                  {
                    "not": {
                      "field": "Microsoft.Network/networkSecurityGroups/securityRules/destinationPortRanges[*]",
                      "notEquals": "22"
                    }
                  }
                ]
              },
              {
                "anyOf": [
                  {
                    "equals": "*",
                    "field": "Microsoft.Network/networkSecurityGroups/securityRules/sourceAddressPrefix"
                  },
                  {
                    "equals": "Internet",
                    "field": "Microsoft.Network/networkSecurityGroups/securityRules/sourceAddressPrefix"
                  },
                  {
                    "not": {
                      "field": "Microsoft.Network/networkSecurityGroups/securityRules/sourceAddressPrefixes[*]",
                      "notEquals": "*"
                    }
                  },
                  {
                    "not": {
                      "field": "Microsoft.Network/networkSecurityGroups/securityRules/sourceAddressPrefixes[*]",
                      "notEquals": "Internet"
                    }
                  }
                ]
              }
            ]
          }
        ]
      },
      "then": {
        "effect": "deny"
      }
    }
  },