How do I download a blue grass banjo software instrument without picking up a virus?

After you installed MainStage, launch it once.

Go to the main menu and select "MainStage > Download additional content".

You should now see a panel like this:

Select all Jam Packs you want to download and wait.

Once installed, restart your Mac.

Then open GarageBand again, create a software instrument track, and in the Library panel select the Legacy section. You should now be able to select the JamPack sounds.

Open the Loop Browser and click the "Loops" menu at the top. In the drop down menu select "reindex all Loops".

I also wanted to find a software mandolin instrument.

You could give the Irish Bouzouki from the World Music JamPack a try. I think the sound is closest to the mandolin from all the guitars in the World Music pack.

To check if all additional content has been installed, use the menu entry "MainStage 3 > Sound Library > Sound Library Manager".

Sorry, I accidentally posted the screenshot from MainStage 2. In MainStage 3 it looks like this:

The JamPack Rhythm Section has a bluegrass banjo. However, it is difficult to buy the stand-alone JamPacks now. If you purchase MainStage from the AppStore instead, it will install all available JamPacks.