Is it possible to restrict ingress and egress traffic between front end and back end Azure IaaS VMs strictly at the network level?
As of Nov 2015 it's now possible to deliver what you're asking for, albeit in IaaS v2.
Firewall-like rules, limited to address ranges, ports and protocols can be delivered via Network Security Groups (NSGs). This is documented quite well on Microsoft's site: What is a Network Security Group (NSG)?
You can now also create VMs with multiple NICs (again, IaaS v2) however be aware that you may be required to increase your VM size in order to add more than one. Again, there's a reasonable article explaining it in detail here: Create a VM with multiple NICs
I received a private answer from the Azure team that effectively said that this is not currently possible. It's a requested feature but there is no set timeline for its implementation.