Is there a way to block our son's ability to purchase tokens or password protect it?

Simple answer... No.

Long answer...  If you wish to block ordering tokens, you will need to place a block in your router on the websites you can order tokens from.

Best answer...  Get rid of his computer time if he purchases them?