You can set a password in the Screen Time settings on his device and restrict purchases by following this support article. In addition to the In-App Purchase setting in this support article, you will also want to set "Installing Apps" to "Don't Allow". There is also a link in that article that provides the steps to set a Screen Time passcode. You will want to make sure you remember this passcode and not use one that your son may know.
Use Screen Time to prevent purchasing - Apple Support
You can also set up a Family Sharing plan where your son ask for authorization from you first before a purchase can be made. This feature is called "Ask to Buy" and requires that Family Sharing is set up first.
Set up Ask to Buy - Apple Support