I initially wrote this with a separate VMware/ESXi host in mind. If you must use your working Windows 10 machine (with VMware Workstation), you need to create/use an isolated virtual network that is not bridged to the hosts outgoing interface. VMware Workstation should have created one for you initially. Your host is however still exposed to this network, which places your working computer at risk.
I recommend a separate ESXi host with a separate virtual switch with no physical adapter attached. Create a port group on this (isolated) virtual switch. The Kali Linux VM should have only this port group attached. You can view the VM remotely through ESXi management, which should be on its own network segment or on a separate VLAN from your internal network. You will not have ssh access to the Kali VM then. The VM will only have access to a network internal to ESXi.
This VM will not have Internet access. To provide Internet access, which may not be desirable, you could install a firewall VM (e.g., OPNsense or pfSense). To use this firewall for your own internal network and for the Kali VM, put your ISP router into bridge mode which places its internal network ports on the live Internet and not on NAT (to avoid confusing double NAT). Use a dedicated physical ethernet adapter for WAN (in addition to adapters for LAN and management, which can be just VLANs on one separate adapter in a pinch). It is imperative this host machine's WAN interface is not exposed to your internal network-- or if it must, very careful rules must be constructed to force all the Kali VM traffic out to the Internet. The firewall VM will need an interface to the Kali Linux port group. Be sure to create rules on all firewall interfaces to restrict access to the Kali network.
