Laptop is kept off, firmware secured, and no disk device of any kind. If you are security oriented, using a non-iOs/Android phone is a step. Several devices passing through the 800, distributing Internet to second device which does the VPN itself propagated to a secured-laptop is the second step. This is a good phone for this.
Link: https://www.amazon.com/Nokia-2100mAh-Rugged-Factory-Unlocked/dp/B07X63JCWT