I don't think of any way right now. The most you can limit on a regular OS X install is the burning of media, not reading. You can, however, block access to media if you have the Server edition of Mac OS X, by using the Workgroup Manager
http://images.apple.com/server/macos...kgrpMgr_TB.pdf. I'm sure there must be some command-line hacks available to enable this in the regular version as well but I can't find any right now.
Sorry for the personal question, but I'm curious to know why your son is allowed to listen to purchased music and not borrowed CDs. Feel free not to answer if you deem it too personal. Is it for the principle or you don't want him to listen to certain genre or lyrics?