I managed to set up GNOME Boxes so that I can use my old Canon scanner from Windows 7. (I tried XP first, but it wouldn't connect to the internet out of the box, and while I could have activated it, if painfully, over the phone, shared folder support is based on WebDAV.) I set the DNS server to 127.0.0.1, which seemed the easiest way to disable internet access, since I really only need this VM for scanning.
I find it irksome enough that I'm depending on Windows to use the scanner, but I can live without the double insult of also depending on Oracle software.