IaaS servers use traditional hypervisors you can install on any computer, typically Xen or KVM (or Hyper-V if you hate money). These typically connect to the network using one of:
- an internal virtual interface (TUN/TAP), which you can then bridge or firewall or do whatever you want with at the containing host level
- programatic in-process NAT (unlikely in an enterprise setting)
- network card sharing (managed by the hypervisor)
- dedicated network card
The network model is up to the implementor. The TUN/TAP interface provides the greatest flexibility, since the VM's network interface shows up as an otherwise unconnected interface in the host OS. When and if to send packets to the virtual interface is determined entirely by the host server's firewall and routing tables. It can be complicated to set up and get right, though.
The network card sharing system is probably the simplest, and therefore the most likely. To all the world, it looks like each VM has an ethernet interface all connected to the same switch. But in reality there's only one interface listening in promiscuous mode, with the host OS determining whether or not to send packets to a given VM. The security model there is the same as you'd get with multiple servers on a single broadcast network.
Finally, dedicating an interface to each VM is the most expensive, but also the easiest to understand intuitively from a security perspective. Each VM has a network adapter, you plug the correct cable into the appropriate adapter, and there you go. This is highly unlikely to find at scale, though, since changes require manual intervention.
As far as what security models are in play; again that's up to the implementor. Simpler places will typically provide NO network security (your server is on the Internet, deal with it), but if they do provide private networks, then their mechanism for doing so is their own secret. There are only so many things you can do, though, so you probably can guess.