I'm not entirely clear what you meant by "isolated non network environment" . . . how I interpreted this, is that you have no network connected to the machine [VMware Workstation Host], and therefore, the users on the 'legacy systems' will not have access to the network !
If you wish to make sure that users cannot physically connect the machine to the network, then would suggest, blocking up the RJ45 connector; remove any network interfaces (Ethernet/Wi-Fi); disable the Hosts Operating System network Adapters; remove VMware's Virtual network externally facing interfaces.
As far as I aware VMware Workstation is not designed around multi-users access, and as such some services may require the appropriate level of permissions for the currently logged on user to function correctly. Therefore, you would have to experiment . . . with quite a bit of trial and many errors, and you're on your own.
It's not entirely clear what your requirements are, or the Host Operating System . . . but you might consider looking into Microsoft's Kiosk-mode, I've used it for other applications, but have absolutely no idea if this works with VMware Workstation.
