Is there a way to block our son's ability to purchase tokens or password protect it?

Or you can just easily block the two easiest ways to order tokens...

http://api.statusmeter.hughesnet.com/clients/get_Products  (That's the URL the status meter accesses when you click on Purchase Tokens, wont block the Usage history in the meter)
http://services.hughesnet.com/service_tools/tokens/index.cfm

Hopefully the children wouldn't know the login information for the Support Center.