it must be encrypted (dm-crypt is the gold standard, either in LUKS mode if it doesn't need to be deniable or plain mode if it does), and only ever accessed from an isolated system known to not be malicious (for example, this includes any operating system with proprietary software)
storing is really the easy part honestly, it's far harder to be safe while downloading it, since that also requires the isolated system to route all outgoing traffic through tor (using a strict firewall to prevent leaks, such as whonix's or tails')
