http://pierovggsterf4w5xplynqtl56srftc242l3g2xloqlty6nv7372xuyd.onion
So, by reading the fine manual, I found an option I had not heard about before: restricted=yes on the user network mode. It makes QEMU create a virtual network, with the usual DHCP server and connection to the host, but without Internet access. In addition, it is possible to specify various guestfwd options.