GNOME Boxes. Much simpler to set up.

It can auto-download operating system ISOs from the internet, but if you already have the ISOs, it works too.

On my machine, virt-manager mysteriously fails, but Boxes works fine.

You can use AppArmor to semi-automatically generate security profiles for each app. Once the profiles are in place, it will enforce Mandatory Access Control, securing each app that has a profile.

Here’s a guide, it’s designed for Ubuntu but will work with any distro.