Coldcard is one you'll hear often, which I use. If you don't know what a PBST is, or know your way around desktop wallet features, get a Ledger or Trezor instead. Those are very beginner friendly devices.

But I also use hot wallets for spending. The keys to these I keep in my iCloud, as I don't particularly care if they're stolen. I may however, begin using a TapSigner. This is an excellent addition for giving a hot wallet the security of a hardware wallet, without losing much of the convenience inherent with mobile hot wallets.

I'd avoid using any multisig setups unless you are using a third-party service like Casa, or you have a very specific reason for using multisig.

In addition to stamping my private keys in metal, and cloning my Coldcard, I made the decision to memorize my keys. Probably was the most powerful moment of my bitcoin journey when I'd memorized them. Very unexpected feeling. I eventually destroyed the metal. Not sure why.