Box 1: 2 -
All network interfaces assigned to an application security group have to exist in the same virtual network that the first network interface assigned to the application security group is in.
We need one application security group for each of the two virtual networks.
Box 2: 3 -
One network assignment in VNet1. Two network assignments in VNET2.
Reference:
https://docs.microsoft.com/en-us/azure/virtual-network/application-security-groups