Is it possible to have a VM directly speak to, say, a USB modem device on a computer that does not have an Internet connection, thus providing Internet access to the VM, but ONLY inside of the VM? Is this a sensible security measure for a box that should have extremely limited Internet services?
It's quite possible, technically. However, I'm pretty certain that if your IT-security guys got wind of it, they would scream out loud, depending on what your IT policy says. I know that where I work, such a thing would be impossible to get approved if I want it to work on a classified system.
The best way would simply to use a stand alone computer where you don't have to worry about security.
No. It is not possible.
A Virtual Machine is just that; a virtual non physical machine that runs on top of a host physical system. If your host (physical) system cannot see or use the USB device in question, then the virtual machine will have no idea about the hardware either. If the host (physical system) has no drivers present to run the hardware (USB Modem) then the guest system generally cannot access or use it either.
What you can try doing however, is plug in your USB device and install the drivers for it in the guest system. Enable the device as a network interface in the host, and set up your virtual machine connection as 'bridged'. Your traffic is still going over the physical machine, through the hardware bus and to the device , but should skip the other network layers.