>>38
I thought you were proposing to not use a vm, and use iptables to block all outgoing traffic that does use tor. This would work until they did an exploit and privilege escalated themselves to take down the iptables configuration.
Using a vm and iptables on the real machine is even better.