macOS 26 network isolation

[retsl]

The docs say:

The vmnet framework in macOS 15 can only provide networks where the attached containers are isolated from one another. Container-to-container communication over the virtual network is not possible.

Is it possible to block container-to-container communication on macOS 26 (without creating a new network for each of them)? I haven't found an option for it. While the containers don't see each other's traffic by default, using e.g. arpspoof they can.