For what it is worth, I have fought these wars with teenage daughters for years. What I eventually settled on was forcing all their traffic throughOpenDNS and paying for an OpenDNS Home VIP account. For $20 per year you can get pretty granular control of what they can connect to: video sites, social media, etc, as well as detailed logs of what they are connecting to. It only works if you can enforce the DNS at the router level to use OpenDNS (and not be circumvented by VPN). For years I ran two small separate routers for the kids: one that was locked down on what it could be used for (but available 24/7) for school work, and a second one that was more or less wide open, but limited availability. Initially I ran dd-wrt router firmware, but later migrated to Gargoyle router firmware because it was more full featured and robust (though, sadly, no dedicated iOS app to control it).
For your situation with the Eero you may have the problem that whatever you set for him, affects you (I don't own an Eero, so I don't know how granular you can be with assigning DNS to users).