When booting from selfhosted netboot.xyz the file from the tftp server (netboot.xyz.efi) is downloaded successfully but access is denied (see image).
The VM doesn't boot. (Using SeaBIOS and netboot.xyz.kpxe does boot)
I'm guessing that it is the secure boot that is failing.
Maybe re-create the VM & when setting the EFI partition/settings un-check the "Pre-Enroll Keys".
I've never used netboot before, but maybe this will work.