Offline. Put the wallet .dat files on a usb stick and keep them safe.
The wallet must have never been on a computer that has connections to the internet before. Doing so may result in your private key being compromised in the event that there is a virus infection.
Even though paper wallet are cheap and quite secure, I would say that an offline raspberry pi with electrum would work much better. For most cases, internet is required to download the UXTO informations. If you use electrum, you can download it on an online computer and transferring it to the offline computer to sign before broadcasting it on the online computer. Even so, no precautions can be made against weak RNG attacks, unless you review the entire code thoroughly and have plenty of knowledge.