I'd use Google Drive to view the PDF's, especially just the Preview should be sufficient for viewing only, and let Google check and update for viruses & safety (using an up-to-date browser).
It also has "apps" for opening PDF's like Lumen PDF and DocHub among others, for editing, etc. (Google Docs itself actually did a terrible job of opening a PDF for me, no images, basically copied only the plain unformatted text into a word processor.)
Then you don't have to worry at all about possibly infecting your local machine, and don't even have to download the files.
And, it's always nice to let Google handle the online backups directly too. Depending how "online" your "online business" is you might never have to keep a single file on your own device, and could have the whole business in your pocket on any device.
If considering a VM, they usually automatically install "convenient" features to use the VM easier, like drag files in/out and share files/clipboard, but AFAIK it's not a secret that the OS is running in a virtual machine.
Several live linux's specifically check to see if they're in a VM and have "utilities meant to be run inside the virtual machine... they provide closer integration and allow to share data through shared folders
between the host system and the virtual machine." So I'm actually surprised Virtual machine escape isn't more wide-spread (related to Hyperjacking too, fyi).
So it looks like it would take more than just opening up VirtualBox with a linux ISO to try using a "hardened" system (but the read-only nature of a live ISO is good, not to mention general immunity to windows-specific threats).