Without more details about your suggested options only more general advice can be provided.
With regards to encrypting files (assuming it is the data of the received email communication), certain malware might be prevented from reading and maliciously modify the data, much less from deleting the data altogether (something that also LSerni comment hinted on).
Consider that efficient malware would strive to gain (or already have) access to the memory of your application , including the key used for encrypting the data. With encryption you might only protect against malware running as unprivileged (non-root/non-admin/non-ring0) code.
With regards to the virtualization sandbox, which sadly is not a very explicit thing to discuss much about, I would state that again this could prevent some sort of malware interaction, only under the condition that the malware again is not running in a privileged code. Frankly it is mostly the way that virtualization is a technology with merits as to contain (restrict/limit) malware, as is the concept of a sandbox. To my knowledge sandboxes are not the method of choice to prevent a program from attacks (by malware), but sandboxes are rather the tool to prevent potential malware to attack legitimate programs/data/systems.
Anyway it seems that a reason to employ either method (encryption/sandbox) would be to protect your email-client-users from receiving malware from the emails, in which case your software (email client) is the vector, in which case it seems that a sandbox might -imho- be much more effective (when well designed) to protect the host system, then the encryption of emails.
- both options, encryption and virtualization, cannot reasonably protect you against bad malware (rootkit, ring 0).
- a sandbox (well designed) might be a more effective tool to secure the host system from your email-client (and the emails), then encryption.