Simply put, use the API provided to send/receive funds from your wallet. Don't act as a mediator for transactions involving a wallet which don't belong to you. Should you wish to do so, they have a third party authorisation tool which sets the app permissions by the other users so you can have a sort of control over their wallet.
To simplify it further, it is similar to using your google account for signing up on other websites. You will be shown a pop-up to grant access.
yes, i'm using their API mainly for receiving only. sending out is other methods. hence, i'm a little worried that coinbase might block my acc if they do not allow me to be my clien't asset custodian.