I've looked at these options a lot this year. There are tradeoffs any way you do this. I like the model of: alpine-linux xen, pci-e passthru to openbsd firewall into hardened gentoo single purpose vm's (music, desktop, reading, web browsing, coding), kind of like a DIY qubes-os.