Overview: I am interested in having an e-mail account designated for receiving anonymous tips as part of a larger anonymous tip infrastructure at my business. My professional domain's e-mail is provided by a popular web-based e-mail service. Because I am soliciting information about potential wrongdoing, I am concerned that someone might send me an e-mail containing malicious code and compromise the larger group of e-mail accounts through my professional domain. In theory, I would only use the e-mail to receive the files, but I would evaluate them on a separate air-gapped machine. This is where I don't really understand (a) the risks if I simply downloaded any relevant attachments and (b) potential mitigation strategies.
Questions: First, should I be concerned about simply using an e-mail address within my professional domain to download files to external media for evaluation on an air-gapped machine? Second, would simply auto-forwarding e-mails from the professional domain e-mail to an external service like Protonmail reduce the likelihood that a file compromises the e-mail service associated with my professional domain?