LXD isolated network

Hi, i wish to isolate my containers by purpose, a container for me db container for another web-app. i wish to create a networks that can allow inbound/download from internet for my db container, and another container than have both access. the last is done with macvlan, so its not a problem, but the first 1, any ideas, what sort of managed bridge do i need?