You have an Azure subscription that contains the virtual networks shown in the following table.

WebApp1 → VM2: Yes. Regional App Service virtual network integration provides outbound connectivity from an App Service application into the integrated virtual network and also to resources in peered virtual networks. Because WebApp1 integrates with VNet1 and VNet1 is peered with VNet2, WebApp1 can reach VM2 in Subnet2. Microsoft explicitly lists peered virtual networks as supported destinations for VNet-integrated App Service applications. Microsoft Learn

NSG1 controls inbound traffic to WebApp1: No. For multitenant App Service, VNet integration is an outbound-only networking feature. Microsoft states that inbound NSG rules on the integration subnet do not control inbound requests to the web app. Inbound access should instead be controlled by mechanisms such as App Service access restrictions or private endpoints. Microsoft Learn

WebApp2 → VM1: Yes. An Isolated App Service plan runs in an App Service Environment, which is deployed directly into a virtual network subnet. Apps in an App Service Environment can reach resources in that virtual network and in connected networks. Because VNet2 is peered with VNet1 and the NSGs have only their default rules, WebApp2 can reach VM1 through the peering connection.