Specific coin's wallet is one and its private key is owned by exchange, and then for user, just give address. Isn't it? So private key for each user will not be given?
And what is good way between full node or API? And is this server should be ubuntu?
And API means this?
https://blockchain.info/api/blockchain_wallet_apiYou do know want to give away the exchange's user account's private key. Because if you do that the user could potentially squander you out of some bitcoins (e.g. setup an open order and then transfering away all bitcoin before order is completed)
Full node is when you know your data is correct. An API is good if you're providing that API otherwise you're relying on a 3rd party to provide you correct information (which is something we don't want in a trustless world).
The server can be anything, doesn't need to be ubuntu.
Yes that is an API, but a more common use for an exchange API would be to retrieve funds of specific accounts (to see if a user deposited money into it or not).
E.g. to get the data of address `1M2n7X42iGAheNSNCNq5nfGq5Z3JeRBw8H` we could just go to this link:
https://insight.bitpay.com/api/addr/1M2n7X42iGAheNSNCNq5nfGq5Z3JeRBw8H