Use an offline wallet. Never let this device to go online.
I guess you meant "cold" wallet sitting on air-gapped device that was never been online and in the future will never go online. Some users are confused with two concept "off-line" device and "air-gapped" one and think if they turn off their WiFi or pulled Ethernet cable that would be enough.