So basically
1. some guy created a wallet on blockchain.info, added a watch only address with 20 btc in it and gave you login to the wallet
2. you sent him fiat money and set 2fa on a wallet
3. he didn't give you a private key

What this means: You don't have any control over the address, you can't block it. He controls the address. You have been scammed and, unless you can find the guy, that's it.  

To do what you wanted correctly, that is, capability to block the address if no key is provided:
make the other party send btc to a 2-of-2 multisig address (google it), one key yours, one his. He will either give you the key/sign a transaction or the funds will be locked.