You could limit his user rights, make him a Standard user and don't let him install new software.

Also, have a look at how suitable a Chromebook will be for his workflow (simpler to maintain from your perspective and harder to infect).