Secure your Windows VM like a normal networked computer, even if it is "only" a VM
You should secure your Windows VM in the same way as you would secure a Windows computer that is directly attached to your network:
- Install security updates.
- Install a virus scanner.
- Run backups for all non-trivial data.
- Disable root/admin access or use strong authentication.
- Only install services that you actually need and disable the rest.
- Keep system logs and track them regularly for important messages.
Don't forget to put limits/quota on your VM to prevent your VM to consume all your hdd/RAM/CPU/network capacity/...
Access to your network
The type of access from the Windows VM to the network depends on your network visualization and the connectivity requirements for VM. A VM will be a sandbox if you set it up as a sandbox (for example using host-only networking). If you set it up as just another device on your network, then it will not be a sandbox, but it will be just another device on your network. If an external user obtains elevated privileges on the VM, it can so the same things on the network as if the device was directly connected to the network.
If, for example your Windows VM is setup as an internet proxy server and an internal or external user gains elevated privileges on that server, it is definitely a security threat, as internet traffic of your entire company can be seen and manipulated by that user.
In general, if there are specific and grounded risks that the Windows VM is vulnerable to attacks, put the Windows VM in a separate network segment and use firewalls and other networking security tools such as a reverse proxy to prevent further penetration.
Access from your VM to the VM host
There are (as far as I know) no real-world cases where a guest can access files on the host other than files that are "normally" accessible through the network or via shared directories. As this is one of your (or "their) concerns, this reference to a VMware document might be useful. I quote:
Virtual machines are the containers in which applications and guest
operating systems run. By design, all VMware virtual machines are
isolated from one another. This isolation enables multiple virtual
machines to run securely while sharing hardware and ensures both their
ability to access hardware and their uninterrupted performance. Even a
user with system administrator privileges on a virtual machine’s guest
operating system cannot breach this layer of isolation to access
another virtual machine without privileges explicitly granted by the
ESXi system administrator.
Although this article doesn't explicitly says so, this is (as far as I know) also true for the access from the guest to the host itself.
What to do with "them"? The "human factor"
Don't forget about the human factor in cases like yours. No matter if "they" know what they are talking about, it's important to take the expression of their concerns seriously (or you risk that their concerns are going into the informal circuit of your organisation). Get your VM expert in the same room with "them" and talk about the concerns and evaluate the risks and the severity of those risks.