I've done 1-4. Forced to use W on work lappy, but I do absolutely nothing private on that thing and I've put it on a separate LAN segment, wired only. Corporate allows no tampering, so it's about what I can do.

I have only one W partition for some specific HW setup related apps that I have failed to get to work or find alternatives for on Linux. That W was locked down as far as I've managed, but now I just remove the LAN cable and don't bother. If I need to install something, I sneaker-net it.