disposable sys-firewall

disposable sys-usb

install & use whonix

keep templates unbloated and don't run commands in them (besides dnf/apt and little else just for management)

keep backups

remember that while the computer is suspended, your encrypted storage (you did encrypt it right?) key is in RAM, and this can be recovered with specialized hardware, so shutdown the computer at appropriate times; Xen unfortunately does not support hibernation.

learn the qubes* and qvm* commands available from dom0 and (some of them) in vms (qvm-copy etc)