Perhaps the safest thing to do, since you are using a VM, is to configure your VM to use "private only" networking. That way, your HQ in a VM won't be able to send email, or even contact the production agents. You could just start Firefox in your VM to check it out HQ's web page.
If you are just worried about emails, you could edit server/conf/hq-server.conf and change server.mail.host to a bad value, like "xl2381lxk" so that HQ can't find the SMTP server. But a private network is still the safest option. I'm not exactly sure when HQ decides to contact the agents, so it'd be safest if HQ had no route to do so 🙂
IMHO, you're being awfully careful. I upgraded from 3.2.6 to 4.1.1 and just charged forward 😉 I had to use the patched db-upgrade.xml, but otherwise, life is good 😉