[squarefoot]

I didn't try, but firewalling the VM shouldn't be hard since it talks through a virtual dedicated interface. Also, one can isolate it from the network and use only shared directories with the host so it can read and write files without going online.