If you've already got Qubes and Xen Hypervisor running, your technical level is high enough for sure. And honestly, your security is already probably good enough.

Qubes has very secure defaults, I don't think you need to do anything else, honestly what you have already might be overkill, but idk your use case.

Make sure you can't see your torrent/download machine VM from any other devices on your network. Use Nmap as long as it's your network. Don't use it on a corporate or university network, it will likely get your device totally locked out and you in big trouble.