It's pretty easy to setup a bunch of pfSense VMs as gateways for various VPN services. Then you can create nested VPN connections through local internal networks. So each workspace VM is compartmentalized at both OS and networking levels. IVPN published my how-to guides for that. They're a little out of date, but the basic design still works well.

You nuke those with an adblocker/contentblocker. Running antiscript alone is at best only half of the solution.

Yes, though IP address isn't too much info. You can mitigate it with a VPN or by not loading external resources by default.