So do you mean amm. The best way and safeties wallet is to install new os from a virtual box or VM ware or any virtual os installer?
I think this is a good idea and secured because if you install a os in a virtual box thats safe then dont install anything just only a bitcoin client with system required.
How about the internet access if you want to deposit your wallet? You said theres no internet access in vm..
I'm talking about Qubes OS. With Qubes, the "appVm's" all have internet access however not the place where you initialize the apps/vm's, in other words the base vm when you start the OS has no internet access. The networking is done on a seperate VM for better security and gives internet access to the app vm's only. So the bitcoin core client is usable as it does have a connection to the internet.
https://www.qubes-os.org/ check out the website and try out the live usb if your curious how it works. It is truly the best OS i have ever used.