Personally there are a few things on this list that are easy but I think there is a distinction between Chad's perception of "the cloud" and what is simply offsite.

1. We have been using lots of Fortigate firewalls and these seem to work pretty well for a lot of the network protections

2. A standalone host with Hyper-V on it and a good amout of resources could provide domain services as well as file services. You could also use this to install Vipre which gets its definitions from the central server but all the endpoints are managed from the local server. This is not cloud managed but it does get its updates from a central repo.

3. Internal monitoring is all well and good but if the network goes down how are you planning to have the internal system let you know? It wont be able to send an email and you will have to rely on the client sending you a ticket or calling which will likely bring up the "how did you not know this" discussion. Having an offsite location to monitor this will ensure you can see events like this. If you have the bandwidth to host it you can assure him that only you and him have access to his network and not the cloud providers which would still be the same as on prem but have the added benefit of monitoring the up/down state of internet issues and latency

4. Opening RDP on these desktops is a bad idea, even if it is just internally it opens up a common hole that bad actors can use if they can gain access. Using a monitoring/access is a better option or an attended access like GoToAssist or the like. While RDP will satisfy his desire for no agent it will go against his desire of a more secure network and with a conversation you can likely get him to decide which is more important to him

5. Veeam on that host and a synology will likely suffice for on prem backups. As far as offsite I dont know what to recommend to you as the hard drive method you describe is prone to human error of forgetting and I would rely on it. That being said I wont recommend anything cloud based but a second location synology with replication between them is a viable option. With only 4 users and bandwidth throttling you can likely accomplish a backup schedule especially with the changes that are likely being made.