How can I create a VM in virt-manager that can access the internet through the host but can't even see the host or other devices on the LAN?

I want to be able to create multiple VMs for testing purposes -- questionable websites, files that could be infected with a virus, etc. I want to make sure these VMs should be able to access the internet (through the host) but they should not be able to access the host or any other device on the LAN. I tried `NAT` mode but that let's me access the host and other devices on the LAN. I tried `Isolated` mode but that doesn't give me internet access. I don't want to run a second VM and route traffic through it. I want to avoid creating FW rules on the host or VMs because I'll be creating and destroying VMs all the time. And I think I need to use some kind of NAT because I don't want my router to know/see the VMs as clients. What do I need to do?