The NSG can be in a different resource group from the cluster resource group.
The master and worker nodes can share the same NSG, but this isn't recommended. The NSG for worker nodes typically allows more inbound traffic than it needs. For master nodes, the goal is to restrict inbound traffic to secure the node.