Maybe UPS has a smart tech guy who set up an machine with TAILS or a similar live read-only OS. Box is connected just to the Internet for fetching those mails with attachments and prints to a printer hooked up bia USB. No connection tomrest of machines / printers. If something b0rks salvation is just a reboot away.
That would probably the smartest solution. Apart from just placing a cheap Staples printer on the counter and telling DefConites to install drivers and just connect to their own machine.