Experimenting With Blackhat

I’d like to experiment with a few blackhat SEO methods without risking my main site. I’d like to build a second website and leverage a few blackhat methods on there.

To ensure Google does not associate my secondary website with my main, the two sites need different hosting providers and IPs? Is that right? Anything else?

You'll be using different domains and different hostings.
The only one who knows both are yours is you, unless you link them: i.e. use the 2nd one as a pbn to boost the first.
So you are fine if both are not linked in anyway.

use different GSC accounts and different billing info when registering the domains

Also don't add them to the same Google analytics account.