What exactly do you mean by “LAN” network? LAN as in Ethernet vs WiFi (or, as other languages would say, LAN vs WLAN, hence my question)?
Or LAN as in “just a specific subnet on my local network”?
If you want the former, I would suggest to create a dedicated NetVM only for your Ethernet controller (I could provide more details if that’s what you want).
If you want to limit your Qube to just a specific subnet there is no reason to create a specific proxy or firewallVM for each Qube. Luckily, that’s exactly what the Qubes firewall is for. In the Qube’s settings (accessible, e.g., via the “Qubes Manager” GUI application or via the Qubes launcher menu) you can specify unique firewall rules for each AppVM. These rules are enforced using the netVM for the specific Qube (so in a standard Qubes setup “sys-firewall” would make sure that the rules are applied to the traffic coming from your AppVM).
Due to this design, there is no way for the Qube itself to circumvent the rules, even if it would be compromised. Just create a rule that says "allow traffic to MY_LOCAL_SUBNET (e.g., 192.168.0.1/24) and make sure to check the option “Limit outgoing internet connections to…”.
Of you want more details, see The Qubes Firewall | Qubes OS