There’s a difference between telemetry/tracking which can at least be limited using an isolated VM, and malware which will attempt to take over your computer/network, so it really depends on why you don’t trust the program.
Imo, if you just want to run a program that’s made for windows (and you trust that it isn’t malware), then a VM or potentially even wine by itself would be sufficient. If you want to run something you think might be malware, don’t. No amount of virtual isolation will guarantee protection from malware.