Understanding security with 2 nics and 2 networks

Hi,
i use acutal 2.3 and want to install a second nic for wan. now i want to understand how secure is proxmox and the build of the internal routing/bridging. e.g. for wan2lan:
wan-router 10.0.0.1->proxmox 2.nic with firewall on 10.0.0.2 <->and proxmox with kvm clients in 192.168.0.x and first nic with 192.168.0.x to internal hardware clients. now the question is, what if i configure a vm client in 192.168.0.x or a hardware client with 192.168.0.x to 10.0.0.3? could this client directly connect to the wan-router? hope you understand my thoughts...and bring light into darkness.