Have a VNet option in the AZD environment configuration, that would put the storage account behind a VNet and that the function app can only reach through VNet integration. This toggle should be on by default, but when changed to false, it should then only use identity and not create any networking assets or VNet integration.
The BLOB-PDF sample should be updated: