I would have them download an idiot-proof light mobile self-custody wallet like Edge wallet. All they need to do to secure their keys is remember a username and password. The app has multiple payment channels for purchasing Bitcoin, and since it's sent straight to their wallet they won't be leaving it on an exchange.