If you don't want him to have email access at all, you can just turn off sync under settings>accounts and wipe data then disable the Gmail client (and google+ while you're at it) under settings>applications. Be sure you remain logged out of chrome as well.
Otherwise, just turn off sync for your own/primary account and wipe data for the client and give him his own email account.
ETA: It's also a good idea to setup a PIN for Play Store purchases on the tablet and set the maturity level for app download. I wish there were a built-in option for requiring a PIN for all Play Store downloads (except updates), paid or not, but as it is, only paid apps and in-app purchases are restricted.
Sent from my GS3.