Can’t you do this using Qubes OS firewall?
Or maybe I didn’t quite understand what exactly do you want.