Most scambaiters use FireRTC, but if you dont already have an account, its no longer possibly to sign up for one. I use textnow and googlev oice (with a verified number thats actually a textnow number ) Occasionally I use Skype out that is still tied to an old mobile phone number I have no used in almost a decade.
I would consider a VPN a must, for several reasons.
First you give away your true IP if you dont use a VPN. Most scammers are clueless, but there might be a few skilled ones or rich ones that want to take revenge.
Secondly, you may need it to pretend being in a different country, particularly if you are not in the US. A VPN subscription really isnt that expensive, and its useful far beyond just scam baiting.
I know virtualbox, never used VMware, but there probably isnt much difference between them. Hiding the VM is necessary if you want to drag out the conversation. Some scammers are good at spotting VMs, others are completely oblivious even if you throw it in their face. Case in point:
Why go through all the trouble to hide your VM?
Scam Bait Club has some excellent tools and tips to hide your VMs. Although be advised, if you install the fake dxdiag then the fake msinfo32 no longer works. In my experience, scammers use msinfo32 a whole lot more (also to point out stopped services), so install that, and dont install the dxdiag, I dont recall any scammer actually starting that.
Anyway, the VM hiding is a process. You simply start with what you have, and as you bait scammers, you will find out what needs improvement as you find out how they discover your VM.