Hey,
either pass the NIC through to the VM (using PCI pass-through), or create a new bridge and have the new NIC as its slave, and attach the new bridge to the pfSense VM. (PVE does not need an IP in that case on the bridge)
Both should work fine, just having a new bridge is probably easier to...