My physical system is connected to WiFi (to get to the internet) and a (hopefully) disconnected-from-the-internet ethernet. Qubes access one or the other, not both. And this is reflected in my color scheme (which doesn’t correlate perfectly with “trust”). Red, orange and yellow qubes connect to Wifi, and purple qubes connect to ethernet. Blue and green are offline linux and windows, respectively. And the veracrypt volumes are out on the Ethernet.