I won't be telling him about that. He deletes emails and even text messages as soon as he's read them, for fear of them causing problems. The last thing he wants is Windows popping up some message, contextually trying to be smart and know what he's doing without him inviting that bot into his world.
Microsoft (and other giants) simply don't get it.
Why are you setting this guy up with Windows 10 then, instead of a system that actually respects the user and has decent security, like Debian GNU/Linux? (There is an enduring notion that Debian systems are hard to install or administer for the casual user, but one might argue that it is 5 years out of date - maybe even 10 years out of date.) Does he rely on some Windows-only hardware or software of some sort - and if so, could he run that on a dedicated, airgapped system?
There are some very user-friendly GUIs out there that are easy to install.
Prepare for a lot of nags about logging in to a Microsoft account.