Networking in Proxmox VE is a Linux bridge plus, if needed, VLANs and the built-in firewall. The bridge joins the physical NIC with the cards in the machines. Without a split, every machine sits together: the test environment sees the database, and the management panel is on the same network as the store.
Why the split
You use a VLAN-aware bridge when production, tests, backups and management should be separate networks. Only the admin network should reach the panel and SSH. Store guests do not get a route to port 8006. Backup gets its own VLAN so a restore does not take bandwidth from the cart.
The Proxmox firewall filters at three levels: the whole cluster, the host and a single machine. That is the equivalent of security groups in a public cloud.
How to set it up
On the node the bridge gets the physical interface and a list of VLANs. You leave the host address on the management network. You restart networking in a window, with console access, because a bridge mistake cuts SSH.
On the machine NIC you set a production or test VLAN tag. The database listens on the application network, not on every interface toward the front.
In the cluster firewall you turn on a policy: incoming traffic blocked by default, outgoing allowed. On the nodes you open the panel and SSH only from the jump host. On the store machine: 80 and 443 from the reverse proxy, nothing straight from the internet.
Network layer: on-prem.
In short: the store, the database, tests and the panel should not sit on one network. You make the split on the host before a guest starts scanning its neighbours.