personally i think a separate machine booted using the tails bootdisk and no write access to anything is probably the safest.