Trying to wrap my head around VLAN's and failing.

Hello,

I'm trying to wrap my head around VLAN's and am not having much luck. As an example, I have a smart display that should only touch one VM on the network, and nothing else. The VM host doesn't touch that VLAN, but through the same interface, the VM touches both VLAN's. The imgur link shows what I'm trying to understand.

SKrB8y1.png (604×480) (imgur.com)

Questions:
1 - Would the connection between VM host and network have to be configured for VLAN 1 & 2?
2 - If yes, what prevents VM host from also accessing VLAN 2?
3 - Would VLAN tagging apply here, and if so, where?
4 - What are the risks of software escaping the VLAN (VLAN 2 in this case)?

Appreciate any insight.