Custom sp_who/sp_whoUsers
First of all I question hiring someone you consider an possible internal threat, but that aside your problem is probably a login vs user problem.  When you do an EXECUTE AS you are executing as a user.  VIEW SERVER STATE is an instance or login level permission.  You can set your database to trustworthy and then it will act as if you are using the login rather than the user.  However if you are using a DBA you don't trust then you would be creating a much larger potential problem than just granting him VIEW SERVER STATE.