Hyper-V external vSwitch and physical LAN: when does VM traffic become reachable beyond the host?

Goal

I want to run a few VMs on a Windows machine with client Hyper-V and give them outbound internet access, without any of them becoming reachable from other devices on my LAN or, worse, from the public internet. I am trying to decide between attaching the VMs to an external virtual switch bound to my physical NIC versus leaving them on the Default Switch.

Constraints and uncertainty

My understanding is that an external switch bridges VM traffic onto the same broadcast domain as the host NIC, so reachability then depends on upstream switching, VLAN, addressing, and firewall policy. The Default Switch appears to provide NAT-like outbound connectivity, but the documentation suggests it is not a security boundary, so I am unsure how much isolation it actually guarantees. I also want to avoid breaking the host's own management IP when the physical NIC gets bound to a new switch. Assume a current Windows 11 Pro build with the Hyper-V feature enabled.

Questions

1. On an external vSwitch, is VM reachability from LAN peers determined entirely by the guest firewall and upstream network, or does Hyper-V itself filter anything by default?

2. Does the Default Switch block unsolicited inbound connections from LAN peers in all configurations, or are there documented cases where it does not?

3. For occasionally exposing one service, is internal/NAT plus an explicit host firewall or reverse-proxy rule meaningfully safer than external bridging with a hardened guest?