May be the approach of Veracrypt for hidden volume would do this:
Creating a VM within a hidden veracrypt partition
Basically, Ali would have an OS which is “approved” on his laptop, and “inside” it will be the hidden Qubes OS …
Best,
3 Likes