If your use case and budget allow, hardware exists for physically enforcing read only networking properties: https://en.wikipedia.org/wiki/Data_diode

I'm not that familiar with applications/current state of this type of hardware, but it seems like it will become more relevant with all the new vulns dropping with higher frequency.