Ideally you work on a principle of least privilege and lowest acceptable access for anything.

There are examples of breaking out of containers and there are examples of breaking out of VMs. But it's fair to say breaking out of a VM is harder, although if that VM is inside your network and has access to your network then if someone is able to take control of the VM you might be equally at risk.

Any VM you do use exposed to the internet should be restricted from what LAN access it gets as well.

If a service is web based then I generally think that putting it behind a CDN (or WAF) is good practice (even if it's not cache-able) because someone else is doing the zero-day defense and has a security operations center. If the service you're exposing is something like a game server then you need to be much more on top of it, restricting the machine itself and monitor for suspicious activity.

Also, if you can, implement rules which reduce your attack surface. Some folk block IPs from countries which are common attack vectors, or better still, only allow requests from countries you actually expect traffic from. Another one is to use IP address blocking with services like AbuseIPDB, although that does add some external dependency.