Assign a dedicated NIC to a KVM guest only

My host (Ubuntu 20.04 LTS) has four NICs. I would like to give one KVM guest (Debian 10) exclusive access to one of those NICs.

So I set the guest-NIC to macvtap and source mode to passthrough. And the network connection works fine, but, like the unanswered follow-up on a similar issue, my guest also sees (and uses) that NIC.

If I ip link set down that particular en-interface on my host, it goes down for the guest also (kind of makes sense).

Am I doing something wrong? I thought passthrough would "give" the NIC to the guest exclusively? Is there any way to have a NIC "invisible"/unusable/inaccessible/down for the host but working for the guest?