Hello,
Yes, the easiest way in my opinion is to use some kind of NAT. You will then hide everything related to NSX-T behind your NAT (you may be able to do it also with NSX-T, but for basic study purposes it is good to use for example VyOS - a small Linux based router/firewall).
On youtube Jeffrey Kusters has a great videos regarding NSX-T and the stuff you would like to do (https://www.youtube.com/watch?v=7d1fwsVlOLI&list=PLF5eL3jdkBq7CAuCd-Eo8qiupcn7chfEX).
I usally setup lab in similar manner - an ESXi host with nested environment inside (2-3 other ESXi hosts, vCenter, NSX-T manager either on the nested hosts or on the physical one), 2 vSS - one for the isolated environment with the necessary security settings on, second for physical host management and outside connection. On the physical host I have a VyOS VM with 2 NICs - one inside a portgroup for outside connection, the second inside a portgroup on the isolated environment and this VyOS VM is basically doing NAT service for the nested environment + more (but that is another topic). Check the series - you will find more than enough regarding this in there.
J.
