http://y6gnjkv2xrjfb7qgs3kmsfyw5qwe7avjvvrnh7wpz5hvtrocm4rbetid.onion/2024/12/22/qemu-restricted-network
So, by reading the fine manual, I found an option I had not heard about before: restricted=yes on the user network mode. It makes QEMU create a virtual network, with the usual DHCP server and connection to the host, but without Internet access.