Open only the required ports on the firewall at all times for any virtual machine. Avoid opening all ports unless absolutely necessary.

Use the NAT rules carefully. Provide a dedicated network IP address for the Internet and translate only the required internal IP addresses to it.

It is good practice to provide differently translated external port numbers for each internal port number when using NAT. For example, if an internal port 22 has to be NATed to an external port, it is always better to provide a larger, more random port number, such as 2323 rather than the default 22.

Assign the network administrative rights only to those users who will be creating and modifying the network parameters of your organization. The rest of the users can have read-only privileges as well.

Implement a good antivirus solution/product and place all your virtual machines behind...