Thanks, you are right.
So, the only way to allow hosts on other VLANs to connect to VMs via spice is allowing connection to 3128/tcp of the proxmox mngmt port. Do you know any other way?
Do you know if spice can be installed as daemon into the guest OS, like a VNC server?