Yeah, being able to configure it with the invoice key instead of the admin key is ideal in this case. Just use something like BlueWallet with it. Or, OP's friend can get LNbits API integrated into his existing app, and then configure each cashier's instance with the invoice-only key. And if he wants to self-host LNbits or switch LNbits providers later, piece of cake.