Qubes OS is nice for that. Set up a plain vanilla Windows TemplateVM (Windows Firewall whitelisting in/outbound connections), clone the vanilla template for each subset of applications, then make a bunch of AppVMs which point to those cloned templates.