You might be able to use something like distrobox instead of a full VM. That would at least put it in a container that you could either run from an encrypted partition or something.
Different users would be the “simple” way you’d normally do something like this under Linux. But if your regular users have sudo access, you can’t really lock anything down.





Linux runs on almost anything these days. I’ve installed Mint on Lenovos, Dells, and HPs without issue (even media keys all worked out of the box). As others have suggested, I’d probably look into used business workstations from the last five years to ensure you’ll get a solid five to ten years out of it.