Right now I'm using a combination of Home Assistant on the server, GrapheneOS on the phones, a pihole set up as a DNS whitelist, and an app that escapes me from F-droid that locks other apps bases on screen time. Took me maybe 10min to find everything and 2 months to set up but that was mostly due to my sheer incompetence when it comes to anything that isn't physical. Along the way I even got a jellyfin server going age appropriate music and video sectioned off for him. When he's responsible enough for it I'll be teaching him how to pirate his own content.