security – Azure DNS Issue

I am trying to enforce a Zero Trust architecture.
I’ve disabled all public access to a mission-critical Azure SQL Database and implemented a Private Endpoint in a “Data-VNet.”

The Setup:

I have a Hub-and-Spoke topology.
On-premises users connect via ExpressRoute to the Hub.
I am using Azure Private DNS Zones integrated with the VNets.

The Problem: My Azure-based VMs in the Spoke VNets can resolve and connect to the SQL DB perfectly. However, the on-premises developers are getting Login Failed or Server Not Found errors. They can ping the Private Link IP, but the SQL connection string fails because it keeps trying to resolve to the Public IP instead of the Private Endpoint IP.

Question:

Without manually editing hosts files on every developer’s laptop (which is unmanageable), how do you technically resolve the Conditional Forwarding loop between On-Premises DNS and Azure’s non-routable IP 168.63.129.16?
Also, How do you handle this at scale when you have 50+ different Private DNS Zones, and you want to avoid the “Double-Hop” latency of a traditional DNS Proxy VM?