- Don't move your coins before the fork, leave them in your wallet, let's call it it BTC-OLD
- After the fork, create a new wallet, let's call it BTC-NEW, get an address from BTC-NEW
- Move all your BTC from BTC-OLD to the address of BTC-NEW
- Install a BCH wallet, and create a new wallet, let's call it BCH-TRANS
- Export your private keys from the (now BTC-empty) BTC-OLD to the BCH-TRANS wallet
- Your BCH 1:1 from BTC-OLD will "appear" in your BCH-TRANS wallet
I believe this is the safest way to split your BTC / BCH in a way that even a harmful/rogue wallet fed with your private keys will not affect the other chain, because both BTC-OLD and BCH-TRANS had to share the same private keys to make the split possible.
Of course there is replay protection but this is enforced by consensus, and that wouldn't prevent a rogue wallet with unencrypted private keys to craft transactions that would be sent to the other chain.