I've used tailscale in the past, it's worked great.

If you ever need to remote in to help them set up or configure something, dwservice.net is wonderful and free too

For simple peace of mind. Close the ports and use tailscale for him to connect. It's free and you can share the connection to only that one person (you can't really spoof your friend's connection with a bot). It basically makes the two computers look like they are on the same network. I use it with my brothers all the time.