Controlling VirtualBox internet access?

Virtualbox does have three settings:

NAT: Allows for outside network access, but the VM cannot see internal systems.

Bridged: Allows for outside and inside access. This is the equivalent of having the VM act as another system on the network.

Host-only: This will allow the VM to only communicate with the host. Essentially, your VM software acts as a router.

If you would like your VM to only see your host, then host-only is the way to go. If you would like your VM to see the outside (you mentioned a few sites), then you would need to use NAT or Bridged and have a firewall configured to grant/restrict access to that machine. I wouldn't recommend NAT, since you would then need to restrict the host machine. I would enable bridged, and use a firewall (or external router) to selectively restrict traffic on that specific IP.

Note: Since you are examining a system for a virus infection, do not install a firewall on the guest OS. It would not be a good test, as you have no real expectation that the malware will not interfere with it, and a firewall on the guest may interfere with the experiment you wish to conduct.