They do provide private networks now, but AFAIK they didn't in 2017. Today, one could use “vSwitch” or “Cloud Network”, or both, to set up private networking. But, if you want to easily encrypt all traffic, Wireguard might still be a good idea.