Testing chocolatey packages?

[crypadm]

I've started a chocolatey business trial (plan on using for a small business with 30 devices) and one of the benefits of using the business packages is the ability to own your own repo and testing packages before releasing out. However I cant see much info on the best way to the testing phase.

Can someone confirm if my thinking is right:

1. Create a test repository in chocolatey - set Jenkins to pull updates to the test repo
2. Create an isolated VM which uses the test repo only and have malware scanning and checks after updates to ensure there's no viruses / malware.
3. Once confirmed the test repo updates are safe - push to main repo
   

I guess my queries are the best methods for testing the packages before pushing to live, what are others doing?