As someone said, it could be the guy's kid, or even a friend of the guy's kids. It's also possible (unlikely, but possible) that it was a duped number (like how a scammer would do).

I would have her speak to her manager and basically explain that anyone who she wants to talk to will have her cell phone and can contact her directly, so she should not allow anyone else to know if she's working or when. The store general manager and others in the leadership team should be a part of those conversations as well. Involve HR if necessary.

Teach her about personal vigilance, both regarding physical and online presence. Physically, she should try to be aware of her surroundings, park in well-lit areas, etc. Many places have contract security, even if it's just the silly little parking lot rovers; she could possibly ask for an escort if she's working late. (Local PD--through a non-emergency line, could be another option for this.) Digitally, she would be wise to increase privacy factors on social media, and if she's doing modeling gigs, to ask that her full name not be used in publicity stuff.

Along with involving the store leadership team, they should be on the lookout for any further attempts at contact, from him or from anyone else. If there are further contacts, someone--either your daughter, the store leaders, possibly a lawyer, maybe you--should inform the person in no uncertain terms that the contact is inappropriate and unwelcome, and if not stopped immediately, law enforcement will become directly involved. At that point you start looking at restraining orders, stalking injunctions, etc.

That's most likely the progression I'd follow, or at least recommend.