Procedure for keeping sensitive data from ever touching my normal hard drive

For Libreoffice specifically, you could just password protect it. LO natively has a gpg implimentation. Otherwise you could LUKS encrypt a USB and keep the files on that. If your threat model is super high then you would need to go out of your way to be certain. As unwelled said, you could use Tails and not connect to the internet. Enable persistence. Then you have your files on an air-gapped, password protected OS that never connects to the internet. I suppose it’s up to you how far you want to take it.