Logging attackers will be highly dependent on how you set up the honeypot system you describe. What methods you expect (or don't expect) attackers to use to acquire access and what they do within the system there.
Secondly you will need a method of identifying malware. How in depth you want to set up logging on the operating system is up to you here. You can log a lot of things... You have to draw the line somewhere.
As for quarantining malware for analysis, the accepted method is to archive or encrypt it. The professional community prefers the encryption method because only the researcher who encrypted it can decrypt it (avoiding the whole "Hey! whats in here?" problem with archives with no password).
Encrypted malware can be safely transported to the analysis machine for debugging and examination. The analysis machine should be a VM. This way once the analysis is complete, the VM is simply nuked from orbit and restored, ready for the next test. The reason we do it this way is to avoid missing a piece of malware somewhere and contaminating a subsequent analysis.
Hope this helps!
I missed the bit where you state "freezing the malware before it executes". You can't. You can use the same heuristics and detection as the antivirus to get known malware before it runs. But then, it's known. Why would you want to analyze these. The unknown ones are, by definition, unknown. Therefore there will be no reliable way to stop them. You will only know after the fact they are malware.
I think a better way to do this would be to replace your windows7 component with a VM in the DMZ, then you can isolate and encrypt the malware through whatever method you wish and then transport it for analysis. Then nuke the DMZ VM and replace it with a fresh version along with your analysis VM. This way, you always revert to the same uninfected configuration. You can also activate the antivirus in the DMZ VM and set it to only quarantine in the case you wish to analyze known malware also.