Look into nextdns: https://nextdns.io/

Set it up on all devices + aggressively make it filter crap (there are block lists you can leverage)

Ublock + privacy badger + https anywhere

Other more extreme approaches: get him a router that has these capabilities and/or if friedly to running a custom firmware on it. Filter at router level.

Set up an always on vpn through a server you control. Filter the traffic.