I have a computer with parabola openrc with only a single port open to send socks5 proxy to the Tor proxy server. That's as good as it gets for me for now. My main desktop is MAC address bound to DNS servers (2 computers) and MAC address bound to the Tor Proxy, and Squid Proxy. I leave some ports open so that I can watch TV with endtv and endstream, which don't work behind squid. So I leave port 80,443,1935 open to general output on my desktop so that I can watch TV still. But you can modify some of the streams to lowest quality (low bandwidth streams) and run them behind Tor, reasonably well if you want to close port 80 and 443 for good. Oh but yeah you have to run it with 3 hops for a good transfer rate, still better than a VPN i guess. So you need to compile and link two versions of Tor, tor_stable with 6 hops and mods, and tor_stock with just the stock configuration with 3 hops. I use tor_stock when I use mpv to get around georestrictions, but you can use it for everything if you lower the bit rate on the streams.

Doing similar port restricting and mac address binding proxy schemes using OpenBSD or Gentoo Linux would be the next step. The final step will be to use dumb 8-bit machines to proxy into the Tor Proxy once someone designs it and produces the software.