I think it’s the best lightweight solution.

In the vein of Qubes, Tails is also a fun derivative to play with if you haven’t. That’s more recommended for USB boot, but on secure machines virtualization of it is good. 

 I have a tails USB I got at a barter blanket.