I recommend using a QEMU guest session with libvirt. This works in both versions.
The standard session requires root, and for some reason this means that VMs couls harm your system more or something
Guest sessions are usable within Flatpaks, GNOME boxes has a Flatpak too. Is the virt-manager flatpak from Flathub? Fedora had one before.
Pretty cool, on debian you may want to use that to get newer versions. Even though virt-manager is pretty slow in updates
Yup VMs dont get access to the system. Unless there is a vulnerability.
For doing malware testing etc, qemu user sessions might be preferred.
You can just use RPM/DEB virt-manager and switch to the QEMU user session anyways. If you dont need some advanced stuff like GPU passthrough (I guess) (USB works) you can use that full time. I do.