I recommend either the OVA (i.e the default "VM" build) or the ISO, although the VMDK should work fine too.

The OVA will get you going much quicker (is pre-configured and includes a pre-installed vHDD image), but depending on the appliance, it may require some tweaking for best experience. Also, the vHDD is 20GB, so if you want more space, you'll need to extend it.

The ISO, is almost the opposite. It requires you to manually configure the VM; including vCPU, RAM, networking and setting how big you want your vHDD. You then need to go through the installation process. Once you complete the install and reboot, you are essentially at the same point as you start when you first boot using the OVA (or VMDK).

The VMDK is more aimed at legacy VMware software (includes a legacy VMX config file that can be imported). Alternatively, (if you ignore the VMX config file) use of the VMDK disk image could be considered something of a midway point between the OVA and the ISO. Like the ISO, you will need to create the VM and do the basic VM config (RAM, vCPU, Networking, etc) yourself. But then use the VMDK disk image rather than a blank/empty one (as you would with the ISO).

The only other detail of significance I can think of, is that the OVA and VMDK include the OpenVM tools pre-installed. But as it's installed from Debian repos, installing them into a VM installed from ISO is as easy as:

apt update && apt install -y open-vm-tools

Note that there is also a open-vm-tools-sdmp package (which includes the open source VMware Service Discovery Plugin - which allows integratration with vRealise). This is not pre-installed in any builds. So if you want/need that, you'll need to install it no matter what build you install with.

Finally, the hash (aka sig) file is to ensure that your download is not corrupted (it includes hashes of the image file). The hash file itself is signed by our release key, so you can confirm that it was built/uploaded by us. In other words, if the downloaded image matches the hash within the hash file and the hash file has been signed by our key then you can be confident that the file is both not corrupt and hasn't been tampered with. I am confident that none of our images has been compromised, but I would encourage everyone to ensure to be on the safe side. In a business production context I would consider this step essential! The hash file includes instructions on how to check the signature, although if you have further concerns/questions, please ask.