Personally I DL on a Linux machine and then upload to virus total. If they are clean, then I transfer them to an old android tablet without internet access for reading. If I was reading them on the machine I'd open them in a linux VM, either alpine or fedora silverblue with network aceess disabled.

The state of the art is qubes OS that has a tool to neuter a PDF by taking screenshots and building a new PDF in different VMs.