Is there a way to block our son's ability to purchase tokens or password protect it?

Place a password on the computer, create a limited user account on the computer just for him, then set up parental controls within Windows.

Teach him that trust is earned. Do it now or try to do when he is 18 or 20.

Monitor your data allowance, supervise his internet access.