But why does NPM enable post install scripts by default? Why is there no way to define a minimum release age for dependency versions? It’s just poor design choices.

you need to figure out what VLANs you need and how the communication (firewall rules) between them should work or not work. Which devices are connecting to your services/proxmox host from which VLANs? To actually answer your question, if you want to figure it out try it in a tested lab setting or do this when you have time. I spent quite some time troubleshooting why certain firewall rules don’t work as expected,