yes, this is fine. if you want a completely encapsulated environment, then you can't use SSH/RDP to access the systems. You'd have to use the VMRC for access, and you'd have to install software from ISO in the Catalog.
It can be limiting, but works well for a completely contained environment.