My bet is you could remove the user. Do some DNS messing about either on your router or hosts file to drop all communications to goguardian and then resign into your sons account.
The end result will be that the school management scripts will still run but they’ll be unable to fetch and install goguardian.
The end result will be that the school management scripts will still run but they’ll be unable to fetch and install goguardian.