use a non-infected device in the first place, (do a secure erase before using it) then you're fine to use your usb even online
you don't need to buy expesive HW like trezor, just be vigilant and don't download random stuff from the web
my hotwallet was never hacked, and i've done with it plenty of transactions
while this is true for someone who knows what he is downloading and doing online (you), it is untrue for technically-unsavvy people which OP probably is. so my advice is always:
buy a hardware wallet. there are cheap ones too.
@Towelielie
good choice. have fun with it.

I am pretty tech-savy I know all shit about viruses and such...
I have windows 10 installed since its been out and never had any virus infect my pc but you never know what can happen in future so I think hardware wallet is best solution for me