Use a dedicated staking computer. Get a refurbed/older laptop or RPi (min. 2GB RAM), buy a new hard drive, make a clean OS install on it, and then never go online with it (other than to stake)--transfer all installation files using a USB key. Linux is safer if you're comfortable with it, but Windows is fine if you are careful. If the latter, go to town on firewall/AV/anti-malware software.
I really want to go the raspberry Pi route for a dedicated staking machine (actually already purchased a kit) but you note that the machine should have a minimum of 2GB of RAM whereas the Pi 3 only comes with 1 GB. Was your suggestion for 2 GB RAM only applicable if I went the route of running an older or refurbished laptop and did not apply to the RPi? I would be running minimal non-staking operations on this machine.
Thanks Eleanor!