From Microsoft documentations,
Prepare a location to host your custom page content (a publicly accessible, CORS-enabled HTTPS endpoint).
Our scenario:
We have successfully host our HTML on a publicly accessible blob storage and AD B2C custom policies are working fine with the customized UI. Our Security team would like to explore the possibility of hosting the html on a private blob storage(or not publicly accessible) due to some network security constraints. It would be great to list only {{tenant}}.onmicrosoft.com on whitelist for accessing the private blob storage.
Is it really possible? Google seems to return no related information.
No, because the client (users browser) must download the HTML from your endpoint. Hence it cannot be an authenticated endpoint.