How to block communication between containers on different Docker networks?

I have a Docker set up which I run with docker-compose. There are two networks, both currently running with the "bridge" driver. It is currently possible for a container on docker network A (aka frontend) to communicate directly with a container on network B (aka backend) if the IP is known, or vice versa.

Can all such communication between A and B be blocked?

Is this possible by suitable configuration in the compose yml file? If not, what docker commands, or other workarounds, could achieve this?

Below is a pseudo example of the docker-compose.yml file I use. I set network B with internal: true, and this indeed appears to block outbound connections from containers on B to the host network/internet. But I can still ping containers on A from a container on B if I know/guess their IP...

version: '3.5'

services:
  proxy:
    image: nginx:alpine
    container_name: proxy1
    ports:
      - "80:8080/tcp"
      - "443:8443/tcp"
    networks:
     - frontend
     - backend

  webapp:
    image: lopush/webapp:latest
    container_name: webapp1
    networks:
     - backend

networks:
  frontend:
    driver: bridge
    internal: false
    name: webapp_frontend
    ipam:
      driver: default
      config:
        - subnet: 172.18.0.1/16

  backend:
    driver: bridge
    internal: true
    name: webapp_backend
    ipam:
      driver: default
      config:
        - subnet: 172.19.0.1/16

The real set up has a few more containers connected to backend, and they use the nginx server as a proxy to the internet, but I don't think the details are relevant here.