libvirt firewalld- common setup recipes?

Hi, Can someone provide the recipes for firewalling libvirt guests? I see talk about it but no clear answers how to correctly implement it. I would like to be able to enable the following typical scenarios: 1. Guest restricted to connecting to existing vpn (privateinternetaccess.com) established by PIA app on a given branch. No in or out connections to LAN resources. No connections to other guests. 2. Direct connection to WAN via gateway. Bypasses VPN. No connections to LAN. No connections to other guests. 3. Guest connection to resources provided by VM host only. I know this is a big ask, but I've been reading posts here & elsewhere and its a bit confusing. Previously I had this kluged together through a series of iptables scripts but it was an awful hack and I'd like to do better this time. This is on kubuntu 20.10 (firewalld 0.9.3, libvirt 7.6.0, QEMU 6.0.0), pretty close to stock setup. Thanks!