macOS as a guest and in the host
This would be trivial with either suggested VM software. 

Make an encrypted sparse disk image large enough to hold the guest storage and then build your VM once you’ve mounted the secure disk image. 

By controlling the encryption passphrase of that store, other admins can only delete the container, not mount and read it.