A longish comment with a bit of answer near the end:
Note that the sharing of actual journal-produced PDFs of the article may fall under the constraints of the Copyright Transfer Notice that you guys signed when you published the paper. Now, publishers often do not like it when you post the published version on your website, though most seem to be okay if you e-mail it to a few people here and there. But it is possible that your boss has been burned by an experience before.
For example, if I were to send the e-print that I got from the publisher, which is watermarked with my name and institution on it, to a random Joe Schmoe, who then puts it into a BitTorrent collection and uploads to The Pirate Bay, whom do you think will be blamed by the Journal?
So while I think your boss maybe slightly paranoid, I do not see it as more so than the healthy kind of paranoia that keeps non-profits like the EFF functioning: somebody has to think about the worst case scenario.
All this is to say:
- Check your copyright transfer agreement to make sure that you are allowed to share what the person is asking for.
- Check with your boss to see whether his reservations about sending digital reprints also extends to a pre-print (original manuscript before peer-review) or a post-print (the accepted manuscript after the peer-review rounds but before the proofs were prepared). It is quite possible that his policy is based on a quite literal reading of the copyright transfer agreement, and he just wants to prevent commercial use of the reprint. (If yes, go here.) If not....
- ... check whether the person sending the request is happy with a pre/post-print and if so, everyone is happy. If not, the ball is now in the court of the person making the request to explain why he or she wants the version of record and that only.