If you make his account use Parental Controls, you can get a log of websites visited, although it's not always complete, and likely to be very long indeed, but not affected by clearing history. Naturally, you'd need to be certain that he doesn't know an admin password to change his account back & forth, or erase these logs.
However, with little effort ( a quick search ), he'd find out how to create a new admin account & hide it, or reset the current password etc... the only way to prevent that is with a Firmware Password, but that's also easy to get round, except on late'ish models as detailed here, where resetting/removing it typically requires help from Apple.
There is 3rd party, paid-for 'monitoring' software available, some of which would likely be less obvious than parental controls... until you act on the results.