The best way is to buy from an exchange depending the country that you are but I believe that Binance, Bybit or Kucoin should be operating in your country. Register with any of these exchange that operates in your country and complete their KYC verification first.
These are centralized exchanges that only allow 18 years old and above. Except maybe his dad or mum can give him one of their identity documents to get the verification done.
How did you buy the first €20 bitcoin that you said you bought.
This is just it. He used P2P like from somewhere like on this forum, through telegram etc cetera. Or he used centralized exchange that do not like KYC. Or a decentralized exchange.