[ovirt-users] Client separation on bridge level

Hello everyone, is there a way to seperate the traffic between VMs on the same bridge on one oVirt-node with built-in tools from ovirt? We have VMs using the same bridge which should never be able to talk to each other. We are currently using ebtables for that, but its not working very good anymore now that we upgraded to 4.3 with firewalld. Any suggestions would be greatly appreciated. Best regards, Hendrik