If you give them an address from mycelium (downloaded from your app store) the most they can do is send funds to it and see what your address is doing.

I'd make a new account purely for the second thing and then pass the funds through a mixer if possible - like chipmixer - (or an exchange like binance) to try to break the chain of tracking they'll be able to do if you send within your own wallet.