Yes, you can get audio queues when moving the mouse around. It plays a beep, where left to right panning represents left to right position on the screen, pitch represents up and down, and loudness represents brightness of the mouse pointer. The feature is turned off by default, though, and I have never ever used it. I guess you could memorize the positions of icons and click them, but why on earth would you? Maybe for an app without keyboard access, I guess. But I think I'd find a different app to use.
Ad blocking is not only good for security, it's also a big accessibility win. Getting rid of ads that open windows, move the focus, play loud noises without warning, show bouncing blinking animated images, etc, makes everything so much easier for screen-readers. I also use UBlock origin for that. The only catch is you need to whitelist facebook if he's going to use it. UBlock blocks some JavaScript that facebook uses to make accessibility improvements.
Another addon I run is
$1. It makes accessibility improvements to popular websites like Reddit, Youtube, and fixes common access problems found on many sites. Full disclosure: I'm involved with testing and development for them.
For getting past CAPTCHAs, I have the best luck with
$1. But if he's knew to the web, he might not need that for a while.
I also use 1password, Down Them All, Video Download Helper, Grease Monkey, and Chatzilla. But I don't think those are things he needs until he wants something that does those things, if that makes sense. And I don't recommend noscript for anyone. I'd consider myself an expert user, and even I don't have time to consider the security implications of every single JavaScript file on every single page.
As for antivirus, I don't run one on Windows 10. I find that they work really poorly with screen-readers. Because the virus checker wants to make sure a virus can't click past its warnings, virus scanners often disable screen-reader access to all of there warnings and dialogues completely. Because anything a screen-reader can do, any other automated program could do. What I do is keep UAC on the highest security setting, and disable running unsigned executables. If NVDA was installed as administrator, it can read the UAC prompts. Then just train him not to click "yes" unless he understands why he should.
As for word processing, yes, Google Docs works fine. But I personally prefer Libre Office. I suspect this is because at 28, I'm already old and cranky and want these darn kids with there web apps to get off of my lawn! Back when I was young, an office suite was a huge program with a hundred million features that nobody understood, that takes 2 or 3 minutes to launch! Libre Office continues in that tradition, the way God intended! LOL. Seriously though, I just don't feel comfortable with browser based word processing, and I can't clearly articulate why.
GMail eventually did convince me to give up Mozilla Thunderbird for webmail, and I've been fine with that for 3 years or so. And Docs is perfectly accessible, just like GMail. But...but...I DON'T LIKE IT! I just don't want to do that in the browser.
Another app I highly recommend is
$1. When the installation asks you, select "simple layout", and it will work perfectly. It's the best audio player, ever, hands down. It's much faster than iTunes, and much more accessible. It can rip CDs with the right components, it can play formats like flac, and it's just all around a joy to use. If he wants to play videos and things too,
$1 can be made accessible, and is the best media center option available.
If he wants to read ebooks, assuming you don't have philosophical objections to paying for software,
$1 is a good option. Full support for Epub and PDF, and books from Bookshare. And for books with DRM,
$1 is the accessible, free way to crack them.
If he ever needs it,
$1 is the most accessible way to deal with zip files.
If he ever wants it, the Twitter client I prefer is
$1.
And I think that covers all the software I use regularly.