You can use a library like bitcoinjs or bitwasp(PHP) to generate seeds, private keys, addresses and create a system manager. So users have to deposit to an address, then a simple sync server will check for deposits using online APIs (free or paid). For withdrawals, you will create a raw transaction and broadcast it through the same way (online APIs). With this way, you don’t reveal private keys, and you may use proxies to connect with these APIs to hide your actual server IP.