You create a virtual machine, which is like an actual real machine, complete with BIOS and everything, and then you install XP in that, yes.
So, you wind up with XP running on your machine, and XP running inside a virtual machine running on XP running on your machine. You can then surf with the VM XP, knowing that you can just discard this VM if it becomes compromised.
Its really quite secure, since to the VM, the host OS is just another machine on the network, it has a firewall, etc.
Not just for XP as a VM, though. You can run Linux inside a VM, have access to the command line, tools, etc, but still be able to surf the Net, use e-mail, games etc on your XP host OS.
Its the future.
You have to install XP in the VM as if it was onto a newly built machine ; you then have to install applications onto XP as normal, yes.
The only difference between the VM and a real machine is that the VM exists only as some files, and runs on any machine that has VMware installed.
Vmware is available in many flavours, some are free and it runs on Windows and Linux, and is coming to the Mac. VMs created on Vmware under Windows run on Vmware on Linux and vice versa.