It’s easy enough to add a separate user as a “child” where you have to approve any purchases to keep them from charging anything.