To address the question in your subject line first, there is no product available that is capable of prevent access to *all* pornography. Anything that claims it can is lying, but some can do very good jobs, especially with the most common domains and website.
Most of the "porn blocking" software is a rip-off, and either makes the computer more difficult to use, or just doesn't do a very good job.
The single most important thing you can do with all of this, beyond whatever products or technologies you use is to make sure that he doesn't have administrator level access to every device he has access to. If he has that level of access it doesn't matter what you do, it can all be bypassed, disabled, or removed.
As for images on google, or any search engine, it's true that OpenDNS cannot block images. Since OpenDNS is a DNS based service it knows nothing about websites, web pages, images, content, or anything else that is not strictly a domain name. To make certain that images can't be viewed in any way on goggle you'd have to block google (or any other search engine) entirely.
However, there are ways to force Google SafeSearch on every device on your network. OpenDNS is providing this information that they received from Google on how to do this, but it's not something that OpenDNS can do for you. You'll need to configure it yourself. Granted, the methods discussed are beyond the technical ability of many people to implement, but it is an option. Many other search engines provide a similar "safe search" capability, but you'd need to check with them how to do it.
With search engines the best approach might be to block the entire category and then allow (by whitelisting) only the search engines that you are comfortable with (presumably that comfort would include porn filtering, including images, by default)
Yes, with most routers, if someone has physical access to it they can reset it back to default, which depending on how your ISP does things may override all of the settings you've put in place, including things like OpenDNS. It might be possible to physically lock the router inside a box (that has opening for needed cables and ventilation) that would prevent that, but if the router supports WiFi that might be disrupted. I've heard of routers that are sold with this specifically in mind, but I can't refer you to one since I can't think of any brands off the top of my head.
Another things to consider with laptops, cellphones, and even desktop computers is the device connects to a different WiFi network that's a very simple way to bypass any settings you put in place. And of course any cell phone that uses a data plan can always use that for accessing the internet without the settings on your router. Removing admin permissions on the computer can reduce some of that, and some of the OpenDNS plans include a software agent that isn't easily bypassed if he doesn't have admin permissions.
This is only a basic primer on things, but if you have any more specific questions I and others on here can try to answer them.
