I have a physical/dedicated server which is running Debian 9 (Stretch). The server has enough resources to support its own load and the load of some virtual machines (in this question: Windows Server 2016 Standard edition).
To simplify this question, I will use Debian host to refer to the physical/dedicated server which is running Debian 9 (Stretch), and Windows VM to refer to the (currently not implemented) Windows Server 2016 Standard edition virtual machine that runs on the Debian host.
The Debian host uses KVM/QEMU/virsh to provide virtualization capability and its configuration.
The Debian host currently does not have any virtual machines (or networks) configured.
The Debian host only has one physical network card (NIC) which is mapped to the network interface
The Debian host itself provides various services that the Debian host also should provide, when it's hosting additional virtual machines.
The Debian host should (scope of this question) host one Windows VM. The Debian host and its services should be able to access the Windows VM via a private IPv4 network/address. The Windows VM should be able to access the Debian host by the same IPv4 network (private IPv4 address of the Debian host). The Windows VM should not be accessible via a public IPv4 or IPv6 network/address. The Windows VM should be able to access the Internet (outgoing connections). The Windows VM should not have a public IPv4 or IPv6 network/address assigned to it. A proxy on the Debian host should proxy specific incoming connections to the private IPv4 address of the Windows VM.
The Debian host should further (relevant for this question) be able to host further virtual machines (other Debian instances). All the virtual machines on the Debian host should be isolated from each other. Meaning Debian host can reach all of the VMs, all VMs can reach Debian host and Internet, but the VMs cannot reach each other (directly).
I found some concepts about VM networking. However, I could not find a solution that matches my needs. The closest (but not matching) concept I could find was: Bridge networking. With this, the Windows VM would be connected "to the Internet". This is not desired. The other concepts (NAT, Host-only) either don't allow Host -> Guest or Guest -> Internet access.
My question is: Is my planned network design possible with one virtual NIC? How to implement such network design with KVM/QEMU on the Debian host and Windows VM?
Due to networking restrictions on the hosting providers' side, I cannot use a public IP address inside a virtual machine (IP to MAC filters). Also: I don't want the VMs to be directly accessible from the Internet.