Clean install of Windows XP (you can use the license key of the edition already on there - if you don't know it download SIW and it will tell you - if it hasn't been activated in the last 90 days there shouldn't be an issue with Microsoft).
Then fully update and install any software he needs to use.
Don't bother with security software - buy a copy of Farionics DeepFreeze Standard
Deep Freeze means that anything that happens in a session will be wiped and the 'standard install' you built will be restored when the computer is restarted or booted from cold.
If you want to make changes to the protected partitions you have to boot the machine in 'thawed mode' and then turn on the deepfreeze again when you have finished.
You can stop anyone tinkering with the Deep Freeze setting by requiring password access to the thawing functions.
If you want antivirus protection it is designed to integrate with your security of choice (Microsoft Security Essentials is free and very good, and has minimal interruptions to the user) or the same company do an AV product that works with DeepFreeze so that it can be updated.
I wouldn't bother with a firewall beyond windows firewall. Any non-savvy user can't manage an active firewall - they just let everything through or nothing - either way you have a big headache!
Basically he would have a computer that always clears any nasties from the system at startup or restart and the computer always starts in a known state.
There is a free trial version if you want to play with it and it is compatible with XP, Vista, 7 and MacOS