What is the recommended way to handle dropping forwarded packets?
Firewalld is using policies to control forwarding between zones. See man firewalld.policy as well as https://firewalld.org/2020/09/policy-objects-introduction for introduction and https://firewalld.org/2020/09/policy-objects-filtering-container-and-vm-traf... for applying policies to filter VM traffic (it is just one example, not exhaustive description).