What is the recommended way to handle dropping forwarded packets?
Firewalld is using policies to control forwarding between zones. See man firewalld.policy
as well as
https://firewalld.org/2020/09/policy-objects-introduction for introduction and
https://firewalld.org/2020/09/policy-objects-filtering-container-and-vm-t... for
applying policies to filter VM traffic (it is just one example, not exhaustive
description).