it does not make sense to run a Tor relay in a vm.
The value of a limited environment is in case the tor daemon gets exploited. A full vm needed, tor's not an OS, so perhaps not. A static tor in an equivalent of lighter BSD jail, probably a fair balance. A dynamic tor in full access OS [root] shell... as with any other service best practice, hell no.
As to NAT, the fewer the better, especially not consumer DSL/Cable "routers" that tank under load, those should be bridged to a real BSD/Linux box that can handle it.