One "online" machine that has full copy of the blockchain and only public keys... aka. the "watching wallet"... and then one "offline" machine... airgapped, with no blockchain, but with the private keys etc.. After you have created the transaction on the online machine, you transfer to offline machine via usb, sign it with the private keys... then transfer the "signed" transaction back to online machine via usb and broadcast it.
In all honesty, you are just better off getting a hardware wallet... it achieves pretty much the same thing but without the requirement for a second PC and a lot less hassle etc.