Then run them with only some variant of ChromeOS or similar on it.
Root FS is immutable, all content goes over a wireguard secured network connection. No network? No files.
"What do you mean you can't get in? It says here you're trying to access content just fine... You said you're where? Moscow? I'm sorry sir but we can't risk that."
