You don't only need a VM. You also need network isolation from the rest of your network (unless you already expose your whole network as routable on the Internet).