I do the same. nftables on the proxmox host. nftables on all linux machines. And my windows vms use the windows firewall because its there. Then there is the router firewall that I use for routing between vlans. Plus, with my kvm connected to the proxmox host, I can login to the cli/console...