It really doesnt matter much imo. The obvious best choice here would be three copies on three media in three locations. You can also argue for more. It depends on your threat model. If you have an offsite backup that is reachable from the host machine, a ransomware attack can still devastate you. I have therefore made deaddrops for backups so no machine or user has access to all of them.