I'm working in an environment where students need to access a subfolder on D:\ for (VMWare) virtual machines. Obviously they need full permissions to this folder to be able to run the VM, but shouldn't be able to write anywhere else on D:.
Yes you can.
The trick is to stop inheriting permissions for the folder. To do this, right click on the folder, click security, click advanced, click change permissions then untick the include inheritable permissions checkbox. After doing so you can freely set the access rights for the folder differently than its parent folder.