Your honey pot will be taken over by the attacker; that's the point. So anything that can be done from that machine will be power granted to the attacker. Therefore, you should configure things such that the attacker does not gain any new power that way. This means the following:
All other machines in your network MUST consider the honey pot as hostile (after all, it is the attacker's machine -- or will be at some point).
Beware of IPv6 ! Many operating systems enable some link-level IPv6 networking by default, and that could be used by the attacker. Better place your honey pot in a subnetwork of its own (your VM should be able to do that).
You should endeavour to block outgoing traffic from the honey pot. Otherwise, the attacker may use it as a relay to start attacking other, external systems, and that second attack will seem to be coming from your network. At best, you may be able to prove that you were just an innocent victim, but one could claim that by setting a weak machine which could be use as a relay, you just became an accomplice. You should block outgoing TCP connections, and for UDP packets, only allow DNS request to a specific server (e.g. Google's 22.214.171.124).
If your VM technology is VirtualBox, see the manual. You will probably want to use host-only networking and setup firewall rules on the new loopback interface that VirtualBox will add to the host.
One can guess that I am not a huge fan of the honey pot concept. It is somewhat fun, and a good research tool when studying attackers' behaviour, but it is also risky, both technically and legally.