Can I use that one keepkey device to generate separate addresses to hold the retirement crypto? The custodian has told me that they would just need the public keys.
You can connect your keepkey hardware wallet with Electrum wallet and you will be able to see or generate as many addresses as you need, but I don't understand why you need any custodian for this.
I am not sure what the procedure is for other wallet but here are instructions for Electrum Integration:
https://shapeshift.zendesk.com/hc/en-us/articles/360060952191-Electrum-Integration-with-KeepKey