Currently we have no way to automatically configure this.
For now you'll have to do it manually: create another apparmor profile which includes the lxc-container-default file and has an `allow mount fstype=nfs` line, run apparmor_parser on it to load it if you don't want to restart, and specify an lxc.aa_profile line in the VM config with that profile.
Note that apparmor comes with a secondary profile to allow mounting in general (not just nfs) which you can use if you don't need to restrict it to NFS-only. (That would be lxc.aa_profile = lxc-container-default-with-mounting)
