yep, I wanted to sugest the above or in other words:

Account 1 with 12931391 NXT
Account 2 with 10 nxt

In Acocunt 1 we put a lock that it can not transfer out until it receives transfer in from Account 2 and make it permenent obviously if we lose Account 2 passphrase we are screwed but it will be very hard to be cracked. Unimpossible to be cracked
Also in Account 1 we will not show the account number (Account 2) that we are wiating for transfer in from.

I think this will work!

Also a permanent option to restrict account for transfers out and other improtant features to be restricted to a list of IPs.
And only from that list of IPs to be able to do anychanges, like add/remove IPs or enable disable transfer out.
Unsure if this is not too heavy on the network storage but the above with locking transfersout in Account 1 with only option to unclock with transfer in from Account2 sounds easy