You could limit his user rights, make him a Standard user and don't let him install new software. Also, have a look at how suitable a Chromebook will be for hi

You could limit his user rights, make him a Standard user and don't let him install new software. Also, have a look at how suitable a Chromebook will be for his workflow (simpler to maintain from your perspective and harder to infect).