What exactly is a model of $\mathsf{ZFC}$? According to the Stanford Encyclopaedia of philosophy,

A model of $\mathsf{ZFC}$ is a pair $(M,E)$, where $M$ is a non-empty set and $E$ is a binary relation on $M$ such that all of the axioms of $\mathsf{ZFC}$ are true when interpreted in $(M,E)$.

However, $\mathsf{ZFC}$ proves the sentence $\neg\exists x\forall y(y\in x)$. So what is meant by "$M$ is a non-empty set"? It seems that if by set we simply mean an element of $M$, then $M$ cannot be considered a set.
 A: The phrase "when interpreted in (M, E)" is doing the heavy lifting here. It means (among other things) that the quantifiers are restricted to ranging over M. (M, E) thinks that $\neg \exists x \forall y (y \in x)$ is true, but only for the elements of M. Which means that M cannot be an element of itself, but we already knew that.
A: You have a confusion between what’s internally provable and what’s externally provable. Let’s say we work in ZFC, then we can define in a precise manner that a model of ZFC is a set equipped with a binary relation which satisfies certain axioms. Just like how you can define what a model of the group theory axioms is. Now ZFC clearly proves that a model is a set. On the other hand the model can’t internally prove that there is a set containing all sets.
A: Here’s another way of saying essentially the same thing as the others. When we talk about a “model” of set theory, we’re implicitly working in some ambient meta-set theory. This point is well illustrated by the following example:
Proposition: The hereditarily finite sets (HF) are a model of ZFC$-$Infinity.
Recall that HF is the collection of sets that is generated by staring with the empty set $\emptyset$, and then taking the power set over and over again. That is,
$$\text{HF} := \bigcup_{n \in \mathbb{N}} \mathcal{P}^n(\emptyset)$$
Where $\mathcal{P}^n$ denotes the $n$-fold composition of the power set operation.
To prove that HF is a model of ZFC without the axiom of infinity is some work, but it should be pretty believable.
Now here’s the thing, ZFC$-$infinity can be thought of as the theory of finite sets, and we’re saying that $(\text{HF},\in)$ is a model of it. But HF isn’t a finite set, and it’s clear that HF $\not \in$ HF. So what’s going on?
Well, a good place to start is to ask “where did we build the set HF”? Recognize that our construction of HF didn’t happen inside of HF. It happened inside of full ZFC! But we aren’t talking about ZFC… Instead, we have a ZFC-based “meta-theory” where we built HF! We need to be careful when we’re talking about a set from the meta-theoretic ZFC and the theory ZFC$-$infinity we’re building a model of. So perhaps it would be better to call HF a “meta-set” in this context.
This is even more complicated when our meta-theory and theory are both ZFC. This is the situation your question is addressing. The resolution is exactly the same though. When we talk of $(M,\in)$ as a model of ZFC, $M$ is a meta-set.
