Drive access restriction between VMs - Prevent malware spreading ?

[Vingallo]

If networks are segregated correctly, another vector for malware to spread from one vm to another is though storage. 

How can drive access between vms be restricted to prevent malware spreading from one vm to another vm, or from a vm to the host ? 

Is it even possible to contain an infection to only the one affected vm in ESXI ? 

[scott28tt]

The OSes inside VMs only have access to the virtual disks to which you give their VMs access.