Welcome to the forums!
If he has Android Device Manager set up, then you can locate it and lock it there as long as the phone is on.
Also if Find My Mobile with Samsung is set up, you can log into his Samsung account at Samsung.com and do the same thing.
Also reporting it to the cell company they can blacklist it and turn it off, but if you want to lock it and/or wipe it first, you need to do that through ADM or Samsung first.