you need enable underlying provider feature:

az feature list --query "[?contains(name, 'Container')].{name:name, type:type}" # example to list all features
az feature register --name EnableNetworkPolicy --namespace Microsoft.ContainerService
az provider register -n Microsoft.ContainerService

after that you can just use REST API\ARM Template to create AKS:

{
  "location": "location1",
  "tags": {
    "tier": "production",
    "archv2": ""
  },
  "properties": {
    "kubernetesVersion": "1.12.4", // has to be 1.12.x, 1.11.x doesnt support calico AFAIK
    "dnsPrefix": "dnsprefix1",
    "agentPoolProfiles": [
      {
        "name": "nodepool1",
        "count": 3,
        "vmSize": "Standard_DS1_v2",
        "osType": "Linux"
      }
    ],
    "linuxProfile": {
      "adminUsername": "azureuser",
      "ssh": {
        "publicKeys": [
          {
            "keyData": "keydata"
          }
        ]
      }
    },
    "servicePrincipalProfile": {
      "clientId": "clientid",
      "secret": "secret"
    },
    "addonProfiles": {},
    "enableRBAC": false,
    "networkProfile": {
        "networkPlugin": "azure",
        "networkPolicy": "calico", // set policy here
        "serviceCidr": "xxx",
        "dnsServiceIP": "yyy",
        "dockerBridgeCidr": "zzz"
    }
  }
}

ps. Unfortunately, helm doesnt seem to work at the time of writing (I suspect this is because kubectl port-forward which helm relies on doesnt work as well ).