Keepkey is an hardware wallet, it is a HD wallet, which means there are millions of addresses generated, you can use different addresses for each transaction, HD wallet is capable of that.
Can I use that one keepkey device to generate separate addresses to hold the retirement crypto?
Yes
The custodian has told me that they would just need the public keys.
Public key for what, it can be a scam exchange that will later demand for private key or seed phrase, addresses are enough to give to people for payment and to make withdrawal on exchanges.
Why even using exchange for holding? It is not your coin on blockchain, not your key not your coin. Withdraw all your holdings from exchanges to noncustodial wallet and protect your backups.