I recommend 2x Thinkpads, exactly like the guide recommends. It seems reasonable to use System76 or Framework as well. The latter allows for physical removal of networking. Secureblue further reduces attack surface over Ubuntu, although it could be argued it has recieved much less code review.

Thanks - appreciate the advice.