I’m using an nginx reverse proxy with maxminddb for geo filtering. I have it limited to my state instead of country. If I could reliably go more specific I would. I really only rely on external access to the reverse proxy for family. I could use a vpn myself but I’m not bothering with the inevitable and endless questions from family.
I don’t know if it’s realistic or not but I would love to use a client certificate to authenticate with the reverse proxy but I’m not sure of the compatibility with mobile devices or smart TVs. If it would work even a self signed cert that’s valid for years would be a nice layer.
His personal account should be untouched, as someone else mentioned it is done by user, not device. The only thing I would worry about is the possibility of the district blocking personal devices in the future. I’ve never actually bothered to look if it is a setting in Google admin.
The overall scenario is something I’ve done personally. I provided my nephews with Chromebook’s and they are able to switch between accounts. The district has a log of the device but nothing of any real use beyond that.