VMware Workstation: tips on isolated environment please

[stess]

I want to set up a DC environment with DNS and everything else to play with Powershell. How to set up such environment while it has internet connection, able to talk with other VMs, but cannot reach other machines on the real network for virus/safety purpose?
(I haven't start any steps yet... just planning phase)

My current setup is:
VMware workstation Pro 12
VMware network with VMnet10 for Host-only and VMnet11 for NAT. DC will get both 10 & 11 while the rest will only get 11.
Windows Server OS 2012R2 (couldn't find 2016) unlicensed.
Guest OS Windows 10 unlicensed.
Host OS Windows 10 64-bit (if that make any different)

Planning on spinning up 4 VMs. First for DC with DHCP, DNS, ADDC, etc on the same server, and 3 Guest VM.
Primary concerned is whatever I do in these VM CANNOT affect anything else on the real network.
Any thoughts?