Set can_ip_forward attribute to false.

Example Configuration

resource "google_compute_instance" "allowed" {
  name         = "test394a2"
  machine_type = "e2-medium"
  zone         = "us-central1-a"

  tags = ["foo", "bar"]

  boot_disk {
    initialize_params {
      image = "debian-cloud/debian-11"
    }
  }
  can_ip_forward = false
  network_interface {
    network = "default"

    access_config {
      // Ephemeral IP
    }
  }
}