How can I avoid having public IP addresses created in my HDInsight cluster?

Greetings.
I’m working on deploying a private (i.e. VPN-only) HDInsight Kafka cluster.
After ‘terraform apply’ is finished I discover that there are 2 public IP addresses created. for my cluster. I do not want any public IP addresses - this cluster must only be accessible via a private subnet/VPN.
What TF syntax can I use to avoid having any public IP addresses created?