Absolutely! Wireguard (for example) uses UDP 51820 (normally) which will mlre than likely be blocked, but that won’t stop you from using something like cntlm to proxy it over an allowed port like 443/80. DPI or some intercepting proxies would likely still filter it.
Yeah absolutely if he’s downloading Linux ISOs, just use a VPN and you’ll be fine 99% of the time. TOR if he is doing anything else surrupticiaous. 😬