Hmm, it does seem a bit crap.
There are apps that can require a PIN to access other apps: you could probably use one of those (on his account) to lock him out of the Settings, but you'd also have to lock him from the Play Store to ensure he couldn't uninstall it that way.
I don't have a recent Samsung tablet so can't say for sure what the options there are (I believe there are some extra options for multi-accounts on tablets, and Samsung modify Android a lot), but I can't find anything on my phone that does anything sensible like require my fingerprint to switch to the admin account. Which, as I say, seems extremely stupid (though for a company who have so many smart people on the payroll it is amazing how many stupid things Google do).