The theoretical answer is you cannot.  If the attacker has a set of exploits that take over the operating system then they can write to many places beyond RAM or the hard drive.  These places include but are not limited to: the UEFI (for example http://blog.frizk.net/2017/08/attacking-uefi.html), GPU (for example, https://www.extremetech.com/computing/205270-proof-of-concept-gpu-rootkit-hides-in-vram-snoops-system-activities) intel management interface (for example, https://boingboing.net/2016/06/15/intel-x86-processors-ship-with.html). 

On a practical level, if you insist on trying, you have two choices: you can use a cheap device like an Amazon Fire Tablet (still rootable, and still able to attack your router and other devices from the inside), or an IoS device, which is also still attackable, but the attacks are rare, and unlikely to be wasted on you, unless you happen to work for the GRU, CIA, a human rights org that's annoyed a government, etc, etc.