http://pierovggsterf4w5xplynqtl56srftc242l3g2xloqlty6nv7372xuyd.onion
I had already done something similar in the past with a tap interface, but it was not very convenient, as you need to bring your own DHCP server or use manual configuration. So, by reading the fine manual, I found an option I had not heard about before: restricted=yes on the user network mode. It makes QEMU create a virtual network, with the usual DHCP server and connection to the host, but without Internet access.