This now seems to be possible, according to this article. I ran the following command and it added 'calico' to my existing AKS cluster.

az aks update --resource-group <MY_RESOURCE_GROUP> --name <MY_CLUSTER_NAME> --network-policy calico

N.B. It's quite a destructive process as it destroys and recreates all the new nodes, but completed successfully for me.