Configure a KVM private NAT with a guest acting as a gateway to the outside world. Internal guests will be accessible from the outside world via a reverse proxy and port-forwarding rules.
A post on how to set up KVM on a Hetzner dedicated server, resolving issues with setting up the networking.