I've been doing similar things, just in docker instead of a VM (and doing X11 forwarding via xpra). Not entirely happy with the setup yet; I still need to figure out how to do that with two containers so that the browser doesn't get accidental internet access. Not quite as good as a VM, but better than nothing and easier for me to maintain.
Yep, keeping things updated. Right now I have it set to scrape the torproject web site to extract the location of the latest release, so that `make build` can get me an updated browser.