Not sure whether I understand this correctly, can you please clarify the question?
There are basically several ways to separate a VM from the LAN, e.g. creating internal-only networks (vSwitches without uplinks), using virtual firewalls/routers, ...
André
