I think it’s the best lightweight solution.

In the vein of Qubes, Tails is also a fun derivative to play with if you haven’t. That’s more recommended for USB boot, but on secure machines virtualization of it is good.