What I would do is find a router that allows a VPN to be set up on it like an ASUS AX6000 (quick search found it would support it, probably shop around to find something that’s quality). Then I would set it up to broadcast a wifi name like WORK WIFI and set a password on it that’s different than the rest of the wifi your broadcast for home use. Only connect to the work wifi with his work device and all the traffic will go through that VPN. He can get a cheap dedicated IP address for the state he needs from someone like Private Internet Access. They have deals like 3 years for 79 for their dedicated IPs. So really he can go cheaper if he thinks he only needs it for a year and his IP would always stay the same in that state. You just want to make sure the router has a decent enough processor to ensure the VPN can work nicely. Hopefully someone will throw in a mention of one they have used.