Buy your bitcoins through a P2P exchange like HodlHodl. Conduct the exchange using a secure payment method; you can use fiat, other cryptocurrencies, or even Monero for added privacy in the transaction.

For small amounts, you can send those sats to a Lightning wallet to do a DCA (Dollar-Cost Averaging).

Purchase a secure signing device like ColdCard Mk4 or SeedSigner.

Set up the device and create a wallet. I prefer SeedSigner. This is a signing device, so it doesn’t allow you to have a wallet for sending and receiving; it only signs transactions. You will need to create your wallet in a software like Sparrow and set it up as watch-only to prevent access to your private key.

Verify that you can access your wallet with your mnemonic phrase (in the case of SeedSigner, you can have a QR code) and store it securely.

Send your units to your wallet and you're all set.

Get a full node.

Use a VPN before making transactions or accessing your wallets, adding an extra layer of security.

Divide your funds. It’s important not to use the same address repeatedly. Your wallet can create many addresses; divide your funds and don’t reuse addresses. This prevents others from knowing how many units you have.

(Careful) Have more than one wallet. If one of your wallets is compromised, only a portion of your funds will be affected. Be cautious, though, as having more wallets means more responsibility in safeguarding your mnemonic phrases.

Add a passphrase.

Keep your recovery words in another location, so if something happens to one copy, you can still access the other.