I have an untested workaround. It should work, but I'm not sure.
You can share the Enpass folder located at the root of your OneDrive with your son, and give him writing permissions.
Next, you go to your son's OneDrive (on the web), and add the folder you just shared to his onedrive (there is an "Add to my OneDrive" option). This will create an "Enpass" folder at the root of his OneDrive.
Now you can try configure Enpass on your son's phone. As far as I can see, Enpass look for a "Enpass" folder at the root of OneDrive, so this should work.
But I never tried it. As I said, it's a workaround.