Yes, that should do it. If the Playstation re-appeared that could be because he had the account password, and was therefore able to register the device. With a new password, that should no longer be possible.
As a tip, make sure your email sign-in password is also confidential. If he knows that password too, change it. (If someone can access your emails they may be able to reset some of your other account passwords) .
