Either an open-source hardware wallet or something DIY like an offline seed, created from a laptop running Tails live off of a USB stick. If this sounds complex, have a look into SeedSigner - that's the same thing (tiny offline computer), but basically preconfigured and easy to use.
If you buy a hardware wallet, to keep your privacy make sure to install Bitcoin Core and electrum server on any computer that you control; then connect to this node(by entering the electrs Tor URL) from any software that is compatible with the wallet of your choice. This software could even be a mobile app, if your hardware wallet supports mobile phones.