More detail. Let's suppose you have a ColdCard or SeedSigner, both of which support generating seed from dice rolls.

Once the seed is generated, keep it secret on paper until you transfer to steel.

The device can then export all the public information necessary to create a watch-only wallet on an internet-connected device. This wallet has no private data, lets you monitor the balance, and can only construct unsigned transactions. It can also provide you deposit addresses with which you can continue to stack, all without a device that has your seed.

When you are ready to spend, you use the watch-only wallet to create the unsigned transaction and the hardware wallet to sign the transaction (either through usb connection/nfc, or more preferably, qr codes or sd card transfer)