XML VM nic snippet:
<interface type="bridge">
  <mac address="52:54:00:ab:0b:e9"/>
  <source bridge="br0"/>
  <target dev="vnet0"/>
  <model type="virtio"/>
  <filterref filter="local-fileserver-only"/>
  <alias name="net0"/>
  <address type="pci" domain="0x0000" bus="0x01" slot="0x00" function="0x0"/>
</interface>


Network filter definition:

<filter name='local-fileserver-only' chain='ipv4' priority='-700'>
  <uuid>fce8ae33-e69e-83bf-262e-30786c1f8072</uuid>

  <!-- Reference the clean traffic filter to prevent MAC, IP and ARP spoofing.
       By not providing and IP address parameter, libvirt will detect the IP address the VM is using. -->
  <filterref filter='clean-traffic'/>

  <!-- Allow VM to access single ip for samba -->
  <rule action='accept' direction='out' priority='500'>
    <tcp dstipaddr='192.168.1.202' dstportstart='445'/>
  </rule>

  <!-- Drop all other traffic -->
  <rule action='drop' direction='inout' priority='501'>
    <all/>
  </rule>

</filter>