Resources groups are not a consideration for this scenario. They are used to group related resources together, but do not themselves limit what the resources do.
Your choice of networking topology however is critical. You are seeing a bit of that when you discuss using the load balancer, as the load balancer can provide SNAT to the machines behind it to share a public IP address. That IP address can then be put into the network security group to allow "Internet" access. "Internet" with the quotes as this is still within the Microsoft network, but traveling over routes that you would think of as "outside" your network.
Which brings me to my first thought on an answer... design your network appropriately to fit the security model you want.
Specifically this sounds like a case where the VMSS and the VM do not need a network security boundary between them. The default template deploys a VMSS into a new network, but this is not required. If your network security model allows it, just deploy the VMSS into the existing vnet for the VM, or vice versa place the VM into the VMSS vnet.
Remove the creation of a new vnet for the VMSS, and replace it with a reference to the existing vnet.
Reference an existing virtual network in an Azure scale set template
You will still need to set the network security group appropriately to allow the traffic, but since it will be between machines on the same vnet this is easy (and default).
Alternatively, you can achieve a very similar result with vnet peering. Peering allows compatible vnets to route traffic with each other. Compatible generally just meaning you must have non-overlapping IP address ranges on each vnet. Peering also allows traffic to flow across subscriptions or regions if you need to setup a wider network spanning cities/countries/continents. There is a management advantage to peering, as you can separate the resources / billing / security, however from a networking perspective there is little functional difference between a single vnet as described above versus peered vnets within the same region.
Virtual network peering
Virtual network peering enables you to seamlessly connect two or more Virtual Networks in Azure. The virtual networks appear as one for connectivity purposes. The traffic between virtual machines in peered virtual networks uses the Microsoft backbone infrastructure. Like traffic between virtual machines in the same network, traffic is routed through Microsoft's private network only.
If your network security model does require more extensive separation of the VMSS and the VM there are many solutions that can be built with Azure building blocks. Easiest is that VMs will use the public IP of the load balancer they are attached to for SNAT. Or if a load balancer is not present, an Azure NAT Gateway can be deployed for the same purpose (and is preferred over the load balancer if both are present). This gives you control of the Azure VMSS outbound Internet public IP, which you can then use for securing the network security group on the VM. The networks remain separate, and either form of NAT allows you to treat them as having less trust with each other.
Use Source Network Address Translation (SNAT) for outbound connections
Certain scenarios require virtual machines or compute instances to have outbound connectivity to the internet. The frontend IPs of a public load balancer can be used to provide outbound connectivity to the internet for backend instances. This configuration uses source network address translation (SNAT) to translate virtual machine's private IP into the load balancer's public IP address. SNAT maps the IP address of the backend to the public IP address of your load balancer. SNAT prevents outside sources from having a direct address to the backend instances.
What is Azure NAT Gateway?
Azure NAT Gateway is a fully managed and highly resilient Network Address Translation (NAT) service. You can use Azure NAT Gateway to let all instances in a private subnet connect outbound to the internet while remaining fully private. Unsolicited inbound connections from the internet aren't permitted through a NAT gateway. Only packets arriving as response packets to an outbound connection can pass through a NAT gateway.
