create docker network to force outbound container traffic via another container (without host iptables rules)

I have two containers, A & B.

They should exist on a newly created docker (private) bridge network such that:

• A can talk to the world outside the bridge, but only via specified gateway IP
• B caot talk outside the bridge, only to A via specific ip+port
• Prefer not to require use of iptables rules on host.
• Prefer not to require --privileged on either A or B, but specific --device might be OK
• I'm OK with using --cap-drop on B to achieve desired isolation

I've played around a bit with docker network create bridge private-bridge and various combinations of docker run -net=private-bridge but can't get the behavior I'm looking for.

Is there some way to:

• do this with a docker bridge network?, or
• do this with a different standard network type?, or
• should I look into writing a custom docker network plugin?