I would have him use RDP with just a local machine. That way his access is restricted to the office and he doesn't have an actual copy of the data.