No, using any console command on a VAC protected server will not cause a VAC ban.
not official, but a very verbose discussion about what causes bans and what does not.
http://forums.steampowered.com/forums/showthread.php?t=1906399
Allowed Cheats that will never trigger a ban.
Using console cheats in a source VAC server with sv_cheats 1 turned on
allows all players in the server to use console cheats of any kind.
wording of this page implies that console commands do not matter and that VAC would not even be able to detect them.
https://developer.valvesoftware.com/wiki/VAC
When a player is connected to a VAC-secured server (denoted by a
security badge and the letter V in the server browser), the VAC system
checks if any foreign processes are hooked into the player's local
game binaries. If the VAC check finds a positive ID for any possible
cheating tool, the offending player's Steam account is then
permanently banned from all VAC-secured servers after a variable
amount of time. Message displayed to a VAC-banned client.
Valve Anti-Cheat will not detect content hacks such as invisible wall
textures or bright-colored player models. Server admins that wish to
block such activity will need to run a pure server.
wording on this link specifically mentions 3rd party cheats. Not built in ones to the game.
https://support.steampowered.com/kb_article.php?ref=7849-Radz-6869
The VAC system reliably detects cheats using their cheat signatures.
Any third-party modification to a game designed to give one player an
advantage over another is classified as a cheat or hack and will
trigger a VAC ban. This includes modifications to a game's core
executable files and dynamic link libraries.
Further, from personal experience, I have joined VAC protected servers that have sv_cheats set to 1 and have never been VAC banned.
There is no way to record TF2 replays on servers with that disabled. However, you can still use a program like Fraps to capture your game footage for you. This means you have to have it turned on all the time however, so it's not an ideal solution.
Best Answer
You will not get VAC banned for using cheats on your own server. As far as that is concerned you might as well be modding the game; what you do on your own is neither here nor there. In many ways it is easier to "cheat" on an offline server by using commands in the dev console such as sv_cheats 1. It is only considered cheating (to the point of getting VAC banned) if you use these mods/cheats on public servers where you would gain an unfair advantage, for the simple reason that it ruins the game for everyone else. In addition, a server must request VAC protection to actually use the VAC system, so if your friend does not enable that there is no way he'd be banned anyway.
In summary, your friend is free to use whatever cheats he pleases, so long as it is in offline mode only.