If you are working with real malware then use a VM offline. Better choice is use a dedicated offline machine. Its that easy. Nothing else needs to be addressed.