Because of DNAT you're now routing. Your INPUT chain isn't used anymore for this DNATed traffic and it's now the FORWARD chain that is traversed instead. The new destination is
172.21.0.2:8080 and that's what the rules should now care about, not
<VM local IP>:8090 anymore.
So with DNAT in place, you should block your traffic with (in the right order: allow exception, then forbid everything else):
iptables -A FORWARD -s <IP> -d 172.21.0.2 -p tcp --dport 8080 -j ACCEPT
iptables -A FORWARD -d 172.21.0.2 -p tcp --dport 8080 -j DROP
To be sure it's actually done before any system rule, you could do:
iptables -I FORWARD 1 -s <IP> -d 172.21.0.2 -p tcp --dport 8080 -j ACCEPT
iptables -I FORWARD 2 -d 172.21.0.2 -p tcp --dport 8080 -j DROP
Those rules as is might prevent other containers to reach this container depending on configuration, so you might have to adapt them (by stating the external input interface for example). Anyway you have to find a way to integrate this nicely with the system's method of firewall.