At a previous job, we had a "technical task" which formed part of the interview process for junior sysadmins. It involved setting up a couple of servers, VPNing them together, and configuring appropriate routing so VPN clients could access a server on a remote network.
We used LXC for this, but that or docker is probably a sane approach. You get some (not all) of the separation you do from VMs with all the scarce resource requirements of different users. If you consider the implications carefully, you can even give users root inside these containers in certain circumstances.