You have a bit of an XY problem. The problem is not how to safely transfer files to your sandbox. The problem is how to not accidentally transfer the files to a non-sandbox. This is minorly complicated by the fact that your sandbox is virtual, so you will have to transfer the files into a non-sandboxed piece of hardware in a way that only presents risk to the sandboxed part.
A CD-R is an incredibly safe way to marshal data from one machine to another. Being a very old and very simple API, it is highly unlikely that your host will manage to mismanage the hardware in a way which exposes your physical machine (though always possible... that's the price one pays for playing with fire). Contrast this with USB, which is a relatively complicated protocol. I doubt my USB thumb-drive has enough exploitable firmware to turn it into some malicious unerasable attack vector, but I can't be certain. CDROMs are pretty darn simple -- much easier to trust. (Remember, one of Stuxnet's attack vectors was a USB exploit)
And its very easy to see how to not propagate the virus anywhere: don't stick the CDROM in any machine you don't want infected. When you're done, you have a host of sanization procedures available to you. My personal favorite is 10 seconds in a microwave.
Remember, when you're playing with malware, you're always playing with trust. You start with some level of trust that your computers will do the things you think they are doing. As you introduce malware, its not that the computer gains viruses, its that you lose trust. You can no longer trust that they do what they claim to do. Tools like sanitization procedures are designed to leverage what you do trust to restore trust to other areas. For example, snapshots rely on your trust of the host OS in order to restore trust in the client OS you are using as a sandbox.