Both mine and my son's Switches got super banned. My son's friend has asked me to mod his Switch. Now that I know more than I did then, my plan to keep him safe is the following (he definitely has an original, mod-able Switch, on OFW 9.0.1 and a 128GB microSD):

1) boot into OFW and set the DNS settings for the wifi connection in my house to 90DNS
2) boot into SX OS menu and make a NAND backup, then set up emuNAND
3) boot into emuNAND (which I will assume will inherit the sysNAND settings, i.e. 90DNS active on my wifi, etc)
4) setup all the homebrew stuff he'll needs, including downloading from hbAppStore (assume it's safe to do this due to 90DNS above?)
5) turn on Stealth Mode in SX OS, and the Flight Mode and/or delete wifi settings and tell him not to go online in custom firmware/emuNAND
6) boot back in to OFW and change DNS settings back to automatic so he can go online in OFW.