It's pretty easy to setup a bunch of pfSense VMs as gateways for various VPN services. Then you can create nested VPN connections through local internal networks. So each workspace VM is compartmentalized at both OS and networking levels. IVPN published my how-to guides for that. They're a little out of date, but the basic design still works well.