Some time ago, I ran a gaming site. I generated 10,000 (ten thousand) addresses and had my site dev keep it in the site's database to assign to each user uniquely.

Then we had a bitcoin daemon watch those addresses.

The private keys were all on my side, so it was almost as good as cold storage for each user.

These days, it might be better to use HD type wallets and use the master public extended key, so you have an infinite number of addresses, you just need a database to assign each address to each user.