Explanation:
Box 1: 2
Policy definition 1: Disable public network access for all the app slots.
Policy definition 2: Assign tags to all the App Service instances.
Box 2: 1
Group the two policy definitions into a single policy initiative. For the policy initiative make one policy assignment with scope of the three subscriptions.
Note: Azure Policy evaluates resources and actions in Azure by comparing the properties of those resources to business rules. These business rules, described in JSON format, are known as policy definitions. To simplify management, several business rules can be grouped together to form a policy initiative (sometimes called a policySet). Once your business rules have been formed, the policy definition or initiative is assigned to any scope of resources that Azure supports, such as management groups, subscriptions, resource groups, or individual resources.
The assignment applies to all resources within the Resource Manager scope of that assignment.
Reference:
https://learn.microsoft.com/en-us/azure/governance/policy/overview

Standard StorageV2 supports the Archive access tier, which would be the cheapest solution.
Reference:
https://docs.microsoft.com/en-us/azure/storage/common/storage-introduction