Disallow containers to access host's network

Question

In a simple docker-compose structure like this

version: "2"
services:
  app:
    image: myapp
  db:
    image: mydb

a bridge network is automatically created, which allows:

1. app and db to see each other
2. app and db to see the host's network
3. app and db to reach internet

How can I disallow point 2 while keeping the other two?

Does explicitly creating a bridge network make any difference?