The most easiest way I have done this is via my ledger and one smart phone which is only turned on when I need to take out my bitcoin and spend them. So ledger everyone knows it as hardware wallet, you need the passkey and phrases and stuff. However, sometimes the security of your funds can be managed with simple tricks rather than getting too high techie about it! I have Mi phone which is old and I am no longer using it since 4-5 years now. Since then I have formatted it and only have mycellium wallet installed on it. Now the address is mostly used to fund it and I rarely withdraw anything from it. I have kept that phone turned off and locked up in my desk. I only take it out now and then when Mi releases any software's and mycelium updates etc. So far I am doing great, and it serves the purpose of security perfectly.