USB can be OK however you need like a staging machine and scan the files before entry plus use of a write block device on the USB hard drive. These are commonly used in forensics.
https://www.nist.gov/itl/ssd/software-quality-group/computer...
This also tends to be a supply chain and insider threat.