I think by default a docker container will have access to both networks that the docker daemon host has access to(should be easy enough to test, start a container, get a shell in it, then try to ping something on each network from inside the container and see what happens). If you want a particular container to only use one of the 2, you have to tell it so on start I believe
To allow traffic only from the internal network(s) you can explicitly bind a published port to a specific IP to ensure it’s only accessible from that network.
When you invoke docker run you can use either -p IP:host_port:container_port or -p IP::port to specify the external interface for one particular binding.