Physical/virtual network setup

I am setting up a server and am struggling with network setup.

This is what I am trying to achieve:

The problems I have:

1) How to assign "Etheet" to "Pfsense" so that "Host" has no access to "Etheet"?"

2) How to make sure that "Host", "VM1" and "WiFi" are on the same network?

3) What's the best approach of creating a WiFi hotspot in the same virtual network, using "WiFi" interface?

• Main part of this is leaing, so for simplicity, let's say configuration is done through virt-manager.

• I mentioned "PFsense" only in case it puts any restrictions on the network configuration. If it doesn't, it can be anything else.