Some years ago i posted something simillar to your post, in conclusion it is safe to run on a vm and have the ethernet ports pointed to it, i personally use bare metal since im still not too familiar with opnsense to start thinking of migrating to a vm