I have a similar setup running. You didn't mention your Linux distribution, but I'm using Ubuntu Linux 11.10. Any other distribution should work in a quite similar fashion.
As far as I know, the way I'm doing this is still documented somewhat by VirtualBox, but is no longer their default method for connecting the networking of VirtualBox to the host. Basically, you need to install uml-utilities (part of User-mode Linux). Then, add an interface to /etc/network/interfaces, something like this:
auto vbox1
iface vbox1 inet static
address 192.168.1.1
netmask 255.255.255.0
tunctl_user virtualbox
After you bring this interface up, you can then bridge VirtualBox to it. You don't want to bridge this interface to anything else (like eth0) - otherwise your VM would again have full access to the network. Instead, you want to route traffic between this network and any other allowed resources - and in this case, denying access to your VPN network. Note that this requires net.ipv4.ip_forward=1 to be specified in something like /etc/sysctl.conf.
These are the specific portions of my iptables setup relating to the VirtualBox restricted network. You may wish to tweak this to your specific needs, but this should give you a good start:
# Must be able to access DNS running on the host itself (everything else is denied elsewhere).
iptables -A INPUT -i vbox1 -p udp --dport 53 -j ACCEPT
iptables -A INPUT -i vbox1 -m state --state ESTABLISHED,RELATED -j ACCEPT
iptables -A FORWARD -i vbox1 -m state --state ESTABLISHED,RELATED -j ACCEPT
# Allow access out to the Internet.
iptables -A FORWARD -i vbox1 -o $WAN_IF -j ACCEPT
As long as you set WAN_IF to your Internet connection (and add similar rules for other allowed Interfaces or addresses), but don't add an allowed path to your VPN, this should meet your requirements.
