What structural distinctions separate Network Security Groups (NSGs) from Application Security Groups (ASGs) when defining zero-trust microsegmentation across virtual networks? Furthermore, why is referencing logical application groups rather than static IP addresses the most efficient strategy to prevent rule sprawl?