Is there a way to block someone from making purchases besides the 4 digit PIN?
Nope. All devices linked to the same Roku account share the same payment method and PIN restrictions.
You could log into your Roku account at https://my.roku.com and remove your payment method, I guess. I believe that would also prevent any recurring payments you already have in place from being paid.