How to simulate internet for virtual machine?

Question

linux

Greetings.
There is a local network (192.168.0.0/22), it includes a server connected to the Internet. A number of services "looking" into the external network are configured on the server.
You need to test services from a computer on the local network, simulating a connection from outside.
I set up a virtual machine, set up a virtual network for it (10.10.10.0/24) and NAT issued the Internet. But now, in addition to the Internet, the virtual machine also has access to the local network (192.168.0.0/22), which is not acceptable for testing (for example, when checking a VPN tunnel).
Actually, the question is how to give the VM access to the Internet and not give access to the local network, thereby simulating a connection from outside.
Thank you.
UPD:
Host system - Debian Sid (64), configuring virtual machines using Virt-Manager, virtual machine system - Windows XP (32).

Answer 1

Display the bridge interface to which the virtual machine is attached to a separate VLAN. Accordingly, tagged traffic will be separated from the main one.
The structure is something like this: VM → bridge_vlan101 ← ethX.vlan101 ← ethX
Configuring bridges

Answer 2

create an internal network, connect all virtual machines there.
create another virtual machine connected to both the external network and the internal one, which will play the role of a router between them. In vpn to play on it and all that.