Is there a way to block our son's ability to purchase tokens or password protect it?

Would not restricting his Internet access to only a "white list" of websites using the built-in Parental Controls within Windows accomplish the same thing ?