To isolate a compromised EC2 instance, it is best to change its security group to restrict all inbound and outbound traffic, effectively isolating it from the network. Creating an EBS snapshot ensures that forensic data is preserved, and storing this snapshot in an S3 bucket with S3 Object Lock provides immutability, protecting the data from being altered.