OVN is aleady using GENEVE, VXLAN or STT tunnels (the user can choose any), so the isolation is already assured.The scripts provided by ovirt configure a geneve tunnel.
You are free so override this manually to vxlan or stt if you want, let me know if you need any howto info.