Is there a way to remotely disable a domain laptop (SurfaceBook)

Unless you installed some remote wipe software like Prey on the Surface prior to it leaving, you caot wipe/lock the device unless it coects to your network again. At that point, you could remotely wipe the device via something like SCCM.

At this point, the issue is damage control.

1. What passwords and accounts did they have access to?

All passwords he had access to should be changed as soon as possible, as well as any local account passwords (IE Local Admin).

2. What confidential information did they have on the laptop or access to?

There isn't too much you can do here, but if you suspect they took the info with them, you may want to seek legal advice even though most companies don't want to do this as it makes them look bad publicly.

Also, if the employee hasn't received their last paycheck, then you may be able to deduct the cost of the SurfaceBook from it.