Depends on the kind of exchange you're logged into.
My local exchange allows me to lock withdrawls using 2FA and sms lock but I don't think Binance and other popular exchanges allow that. So, you can look up for one, see if it's safe and then start using it for your purposes and share its details with the user you want to allow trading without the worry of him withdrawing your money.
This should really be always be checked first regarding on sites features when it comes to withdrawal if they do have any confirmation or not because we would able to find out if someone can able to make withdrawals or not. Seeing on the situation of op seems like email confirmation would be needed to confirm such withdrawal which means as long that confirmation link wont be clicked then no one would able to withdraw funds no matter what.