I have a small computer that is used as the router for the Internet connection and on which I have complete control over the firewall and over the proxies used for connecting to the Internet, so there are no chances for an unwanted connection to the Internet.
For additional protection, one could run the Internet browsers in a Virtual Machine, to be absolutely certain that there is no way for a script run by the browser to access the physical hardware, assuming that you do not trust the sandboxing capabilities of the browser.
VMs do not provide protection to the guest OS (or it's processes) from inspection and snooping by the host OS, or from inspection / snooping by the hardware the host OS is running on.
If using a bare metal hypervisor, sed 's/host OS/hypervisor/g'