Regarding access restriction by IP roles, does anyone know if it's possible to only assign this to a single role/employee? We do not want to force the restrictions on Administrators or any other users - just a single web services role/user.

I haven't done it before so I don't know the details but this should get you going in the right direction: https://docs.oracle.com/en/cloud/saas/netsuite/ns-online-help/section_1535043532.html

Yes , you can do so for the employee, by going to the employee record and specify the IP rules.