How am I going to ensure safety when running Malware in a VM.

I wanted to do expiriments with a Virtual Machine and malware, but I’ve heard it can leak out through the internet. How do I ensure safety, should I run a VM inside of a VM, and should I disable the internet of the PC or the VM?