I set up something like that once. What I basically did:
Create an internal network. Give it IP addresses and everything but do not route its traffic to the Internet.
Create a virtual machine with a VPN client. Connect it to the normal network and to the internal network. Configure it to allow traffic from the internal network to the VPN and back.
Set up a second virtual machine. Connect it only to the internal network.
You can run a router OS like pfSense/opnSense/OpenWRT on the gateway VM to make your life a little easier because writing good network routes can be a pain. As your computer would also be connected to the internal network, you can SSH into the VMs no trouble. Make sure you don’t enable traffic routing for that interface on the host, though.
I think in my setup, I put a VM inside the second VM to add another layer of traffic blocking, but I don’t think that was quite necessary.