1) You have been given specific advice. Just because you don't like the advice doesn't mean it hasn't been given. In order to give recommendations for specific parts and procedures for this situation, we would have to know the exact requirements of the situation, as well as the intricacies of all security and privacy laws that apply. And we don't, so we can't, which is why someone recommended consulting an expert that actually does know those things.
If it is not an active business (i.e. not an active business environment) then is the whole question simply theoretical, or just planning ahead for a business that will not be opened until some time later in the future?
2) If you have the resources and facilities to keep all possible spare parts in stock, then that's great, and does eliminate one potential problem, but most small system builders do not, which is why it's usually not a good idea.
3) If the lawyer will rely on this server to do his work as a lawyer, and if going without the system for any extended amount of time would negatively affect the law firm, then it's mission critical..
4) You can't do this because we say you can't. 😉
(If there is a legitimate reason for this, fine. If you simply don't want him to use the feature that is actively supported by the developer of the application he wants to use, then that seems to be your problem and not ours.
You are right that this probably is not a difficult situation at all, simply one that should not be done by someone that does not know exactly what they are doing due to the legal implications.