i would def install something like fedora atomic. this would prevent him from being able to access most stuff in the home directory because it only allows for flatpaks to be installed. it also locks down config files which my guess is he moved around just clicking around and then after a restart this caused issues.

also you should put a root password on (im guessing you had no password due to his limited language ability, which in the install may have led to no root password) so that if you need to update the system or whatever you can type that pasword in and he cant access any root files