How to create Shared Access Policy on Relay's Hybrid Connection

I have a need to create a Hybrid Connection (HBC) to interface with 2 VMs and an App Service.  The VMs are SSRS servers.  The App Serivce will call the HBC which will handle the routing to a VM to pull a report.

My issue is trying to set up the HBC with ARM and/or PowerShell.  I have a template that I've been using that works to create the Relay and HBC, but when trying to associate with the App Service I get an error.

NOTE: All of this is ran through an Automation Account that uses the most current versions of the Az.* modules.

Error:

Template (truncated - all params are correct/valid):

"variables": {"hybridConnectionResourceId": "[resourceId('Microsoft.Relay/Namespaces/Hybridconnections', parameters('relayName'), parameters('hybridConnectionName'))]"
    },"resources": [
        {"apiVersion": "2017-04-01","name": "[parameters('relayName')]","type": "Microsoft.Relay/Namespaces","location": "[parameters('location')]","sku": {"name": "[parameters('relaySku')]"
            },"properties": {
            },"resources": [
                {"apiVersion": "2017-04-01","name": "[parameters('hybridConnectionName')]","type": "HybridConnections","dependsOn": ["[concat('Microsoft.Relay/namespaces/', parameters('relayName'))]"
                    ],"properties": {"requiresClientAuthorization": "true","userMetadata": "Meta Data supplied by user for hybridConnections"
                    }
                }
            ]
        },
        {"name": "[concat(parameters('webAppName'), '/', parameters('relayName'), '/', parameters('hybridConnectionName'))]","type": "Microsoft.Web/sites/hybridConnectionNamespaces/relays","apiVersion": "2018-02-01","location": "[parameters('location')]","dependsOn": ["[resourceId('Microsoft.Relay/namespaces/hybridConnections',parameters('relayName'),parameters('hybridConnectionName'))]"
            ],"properties": {"serviceBusNamespace": "[parameters('relayName')]","relayName": "[parameters('hybridConnectionName')]","relayArmUri": "[variables('hybridConnectionResourceId')]","hostName": "[split(json(reference(variables('hybridConnectionResourceId'), '2017-04-01').userMetadata)[0].value, ':')[0]]","port": "[split(json(reference(variables('hybridConnectionResourceId'), '2017-04-01').userMetadata)[0].value, ':')[1]]","sendKeyName": "defaultSender","sendKeyValue": "[listkeys(concat(variables('hybridConnectionResourceId'), '/authorizationRules/defaultSender'), '2017-04-01').primaryKey]"
            }
        }
    ]

Found out that there wasn't a Shared Access Policy on the HBC getting created as part of this template (images of overview and SAPs below).  I have not figured out how to create that either with ARM or PowerShell.  The closest I've found is New-AzServiceBusRule.  However, from what I understand, the Relay is a Service Bus, but how does that relate to the HBC?  I'm trying to understand these cmdlets, but I'm not sure what my Topic would be for the Relay or HBC.

Am I even on the right path with these cmdlets or is there another set of cmdlets or ARM template that relate to the HBC SAPs?