Use Windows LTSC that is stripped of offline requirements, copilot, and the Microsoft store. And use veracrypt. You can set up a container or encrypt a drive such as an external.