I'm assuming that your master branch represents the "policy" level scan, since you want your reporting to represent what is currently deployed to production. Scanning feature branches is typically done via build from a build server or SCM yaml config that triggers on pull requests. The feature branch scan can take two different forms:

1. Pipeline Scan - fast with a 90 sec median scan time, uses the same scan engine as policy scan. Allows you to break the build based on specified severities and/or CWEs. Results are only shown in the build logs, not on the platform. This provides only static findings, though an agent based SCA scan added at the
2. Sandbox Scan - you can use a sandbox and get a full scan with results on the platform. I like to use the branch name as the sandbox name and delete the sandbox after the merge to master is complete. You'll just have to manage your sandboxes so you don't go over 15 (depending on your account config). This provides static and Upload & Scan SCA, and of course agent based scanning can be added into the pipeline as well. Agent based is directly git aware and can show scans against various branches.

This assumes you use the pipeline scan: To see whether the feature branch contains new vulnerabilities, you need to create a baseline file on the master branch. You can then pass this pipeline-scan.jar. The result will be only report issues not in the baseline already.

Examples are here: https://help.veracode.com/r/Pipeline_Scan_Example_for_Using_a_Baseline_File_with_Azure_Devops

Makes me wonder about issues that the feature branch fixed. It would be nice if those were reported as "fixed".