I want to set up an Astaro (Sophos) UTM in a Virtual Machine.

The Setup should be at the end the following:

Cable Modem (one IP adress)
  | [Ethernet]
Sophos UTM (running as VM [VMWare Fusion 5] on the MacMini) 
  | [WIFI]
Airport Express v2 (for sharing Local Network to wireless and wired clients)
1)| [WIFI]   2)| [Ethernet over Thunderbolt Ethernet Adapter]*
Clients     MacMini (Local File Server)

*To have the Mini also protected behind the UTM

So the setup process for the UTM works fine, but then the problems start:

1. I just have one external IP (from my cable modem provider)
   ==> So if I put the VM in briged mode my Internet connection drops, because the MacMini also has its IP adress.
2. If I put the VM to NAT mode the Mini itself is not protected by the UTM

So: is there a way to hide the en0 interface(Ethernet) and the en1 interface (Wifi) from the MacMini, so that they not even appear in System Preferences Network section but are available to the VM?

That way the Mini must connect to the en2 interface (Thunderbolt adapter) to make any Internet/LAN connection and I just use the given single IP from the Cable Modem.

Thaks for any suggestions...

Sebastian