Well, this is a tech support forum for OBi devices, not a parenting site, and I don't have kids, so all I can say is, trust wins out over prohibition. Good luck.
And, speaking of tech support, take a look at the kid's Chromebook to see if you can customize his DNS settings. I don't have any experience with managed Chromebooks, to know the extent to which they lock them down, but I am typing this on my personal, unmanaged CB, and of course, I can set the DNS to whatever I wish.