If you want to be even safer, you could use a physical network-connected KVM. The only interfaces those expose to the connected computer are HDMI (graphics read only) and USB peripherals (write only). Sometimes they can also physically power off the hosts to which they're connected.

It's a pretty darn slim surface for an attack. Technically doesn't meet the definition of an "air gap", but it gives you 100% of the utility of remote work with effectively 0% of the vulnerability, at the cost of a tiny amount of power and a few extra cables in the rack.