How would you isolate a database so only specific services can reach it?

Create a dedicated internal network (e.g., backend-net) and attach only the database and the services that legitimately need to talk to it. Public-facing services that should not have direct database access are simply never attached to that network, making the database unreachable from them at the network layer, independent of any application-level access controls.