[Users] How do Networks and Vlan-tagging work in oVirt ?

I'm struggeling setting up my network in oVirt at the moment as I would like to seperate specific VM's from other devices/clients in my network. I have decent setup switching network using Vlans, this is also the fact for ovirt and the storage nodes where teh ports are seperated between storage and management. Because I want to manage which client can acces which VM I need Vlan tagging. The question is where are we going to do this, on the VM itself or on the network I attach the VM's Nic to. Because of the lacking documentation at this point it's not clear, so I would like to figure out and maybe change the wiki there. I also cannot understand why I can set an IP to a network and only the subnet where I also can set DHCP which puts also the gateway. I'm not able to set None or DHCP and can only add a network with IP, but what IP and why ? Or just a 192.16.x.0 with a 255.255.255.0 subnet ? I hope someone can clear this a little bit more out. Thanks!