Does installing SQL Server Database Engine and Reporting Services in Azure require two virtual machines?

Question

We are evaluating moving a large-ish web application comprising ASP.NET, Classic ASP and SQL Server Reporting Services into Azure, and we want to know the "best practice" for installing the Database Engine and Reporting Services.

In our current environment, we have a standalone Database Engine, and a separate server that hosts Reporting Services. One of the main reasons for this was to avoid external users making direct HTTP connections to the server housing the databases - isolation for the sake of security.

My understanding of our type of MS licensing is that we only pay for one installation of SQL Server, its components just happen to be spread over two machines - this may or may not be accurate.

If we want to have a similar configuration in Azure - will we be be required to pay 2 x the per-hour charge for SQL Server because they're considered to be two independent installations?

Alternatively, is someone willing to make a convincing case that putting the Database Engine and Reporting Services in the same virtual machine does not significantly reduce security?

I'm aware of the Windows Azure SQL Reporting, but this will not cover requirements because we are already heavily dependent on Report Models, Report Builder, Scheduled Report and custom authentication.