Keepass has strong security measures. You can increase the number of key derivation functions in the settings which increases the time to crack passwords if you want stronger protections. You could also use a keyfile and password.
You say the “best”.
I think if you want the “best” set up, using Keepass stored offline only would be “more secure” since it limits the attack surface.
Manual offsite backups + cold storage would technically be “more secure”.