I run VMs on VirtualBox in Linux. Mostly Linux VMs. And I use nested VPN chains, implemented using virtual networks of pfSense VMs as VPN-gateway routers.[0] That guide is pretty old, but the basics are still OK. Specifics about pfSense configuration etc have changed a little.
You could probably do pretty much the same thing in MacOS. But I don't know for sure. I have some vague memories about VM sluggishness in MacOS, but I could be misremembering.
One cool think about Apple is that their online store is privacy-friendly. Just for fun, I managed to create a persona with an Apple account, funded through Bitcoin giftcards. And I managed to buy software for a Hackintosh VM.
0) https://www.ivpn.net/privacy-guides/advanced-privacy-and-ano...
Edit: The most secure way I know is using Qubes. But that may be more than you need. Unless you're already a target. Or you work with malware, or with people who work with malware, and/or are into exploits.
KVM (or perhaps virt-manager on top of KVM) seems more appropriate.
I'm not too worried. I do firewall everything that's not necessary, at every level. That is, the host machine runs a VPN client, and iptables only allows traffic to the VPN server. So any VirtualBox traffic is using that VPN service.
All of the pfSense VMs in my nested VPN chains have pf rules that do the same. And I doubt that VirtualBox would be routing traffic through them. But I'll check.
I'll probably use KVM for my next VM host. The tools have improved a lot in recent years. And I've become a lot more comfortable managing stuff in terminal.
Edit: Now that I think of it, I basically use VMs like applications. On a machine with SSDs, Linux VMs come up in just a few seconds.