Hi Fred,
I am unsure from your message exactly how much network access you
may or may not have for your required VM install operations, so the
below suggestion might be useless for you, but I will send it anyway
on the chance it helps you.
On my main PC (just a desktop with some TB HDD) on my LAN I run
an 'approx" server[1]. In every /etc/apt/sources.list (on that machine and
every other machine) there are only references to that server (nothing
outside the LAN, no deb.debian.org or security.debian.org), so every
Debian package that I install on any machine is then cached by the
approx server and after that can be served to any other machine.
The approx server config file is the only place where deb.debian.org
and security.debian.org is written. It can work with other repos, for example
I configured mine to also cache raspberrypi.org. It does not download
the entire repo, it just caches what is used and downloads the misses.
For me it's the lazy way to have local mirrors without doing any
admin work myself.
When I create a VM, I just specify the approx server, and
the VM installs without internet access, only localhost or LAN access.
The link below mentions other similar packages but I have not tried them.
[1] https://packages.debian.org/buster/approx