If your computer has a TPM, and secure boot, you could reasonably swap out your data drives. So you have one drive for your untrusted programs and one drive for your trusted programs. Never put them in the computer at the same time together. And that would cover a lot of the risk surface.
If you have any connected peripherals that have data storage, like fancy monitors that have a boot drive attached, or programmable keyboards, or anything like that, those are potential vectors to cross contaminate. So don’t plug those into the system with the untrusted programs