I used to complain so bitterly that the computers I had for AI research work, despite being a flavor of Linux, had no access to any sort of networking, making the installation of basic packages a pain.

It turns out the safest way, barring spies who willingly steal, is provide no entry/exit points for data. For smaller organizations or small divisions that's feasible, but super hard to maintain at larger divisions.