The Act says you need permission to use a computer system. Someone performing security testing on a system that is not theirs needs to obtain the permission of the system’s owner first, or they risk violating the CMA. This is a fact regardless of whether or not the system to be tested is a physical server or a virtual server rented from the cloud.
A system owner might choose to make an image of their live system, and provide that copy to a tester, rather than risk damaging their live server during testing. This image can then be sanitized to remove real customer data, passwords to access to other systems, etc.
The tester could then run the image on a virtual machine, or they could load it on to a physical server. Practically speaking, due to both cost and convenience, the tester will almost always use a virtual machine for the task.
In neither case was the tester given permission to access the real system. However, he or she does have permission to test the copy of the system, because it was provided to them by the owner.
The most accurate answer to your original question is “it can’t”, because they are unrelated. As written, the question confuses the difference between “physical/virtual” and “original/copy”. They are technically two very different concepts.
If you want to avoid running afoul of the CMA, you need permission to test the system. That’s all the law says.