Asking users to change their browser settings,especially expert stuff hidden behind about:config,probably isn’t the best idea.
What about using Tor or some VPN for outgoing connections of the VMs?
Then you can offer internet connection without fishy hacks and you can’t be held responsible for whatever users do on their VMs.
Tor is free and while sometimes a bit slow,it’s still better than not having internet at all.
VPNs are paid,but sometimes you can get unlimited traffic for 10$/month or something like that.