how do we manage routing between different OVN networks in oVirt? 

And between OVN networks and physical ones?

Based on architecture read here:

I see terms for logical routers and gateway routers respectively but how to apply to oVirt configuration?

Do I have to choose between setting up a specialized VM or a physical one: is it applicable/advisable to put on oVirt host itself the gateway functionality?

Is there any security policy (like security groups in Openstack) to implement?

Thanks,

Gianluca