Keepkey is an hardware wallet, it is a HD wallet, which means there are millions of addresses generated, you can use different address for each transactions, HD wallet is capable of that.
Can I use that one keepkey device to generate separate addresses to hold the retirement crypto?
[/quote
Yes
The custodian has told me that they would just need the public keys.
Public key for what, it can be a scam exchange that will later demand for private key or seed phrase, addresses are enough to give to people for payment.
Why even using exchange for holding? It is not your coin on blockchain, not your key not your coin. Withdraw all your holdings from exchanges to noncustodial wallet and protect your backup.