Tails is the right base: it routes everything through Tor and leaves nothing on the machine. Adding a VPN is usually not recommended by the Tor Project; it doesn't add much and the VPN becomes a party that sees your traffic. Exit nodes can see unencrypted traffic, so stick to HTTPS and .onion sites, but they don't know who you are. In practice people get identified by behaviour, not Tor: logging into personal accounts, reusing usernames or writing style, downloading files and opening them outside Tor, or using the same session for anonymous and named activity.