Is that one Lightning transfer enough to cut the trace or it is still somehow possible to associate the final address back to the original exchange?
It breaks the on-chain connection, and is
probably going to be quite difficult to trace. But I'm not sure how likely it is to find the trace.
I have a different question for you:
finally I send it (on-chain) to my final cold storage address.
Who are you trying to hide from? Depending on the answer, this may or may not be a good idea. If you want to sell your Bitcoin when it's worth a lot more in the far future, a KYC exchange (or your bank) may ask questions that are a lot easier to answer if your Bitcoin came directly from a KYC exchange.