ATM deposited on Munn while they learn and understand the tradeoffs of doxxing yourself and stack to the gov. (KYC)

If the are ok with KYC -> Strike, but instead of buying sats on the platform, I would have them pay a LN invoice to themselves using Munn or Phoenix and then sending it to cold storage in Sparrow or Nunchuk

If they want to avoid KYC then either continue with ATMs that only require phone number (use text verified for burner number) or use Strike + Robosats for a light KYC option but greater plausible deniability.

Coldcards and Tapsigners are great

BTC sessions for the hand holding if needed