Frankly, salt seems like an insufficiently principled solution as well, far behind the state of art – both on declarativity and reproducibility fronts.
In the long run nixos-qubes (GitHub - CertainLach/nixos-qubes: QubesOS packages and dom0 for NixOS) would seem ideal to me, but as yet its reproduction of the proper isolation model of QubesOS is only partial.