Yeah, this is probably the way I’d go about it. Dedicated hard drive, separate/no network access, no access to other files. Who cares if it is malware if it can’t get to anything.