You are welcome! I’m not sure what you mean when you say “admin ftp”. Each FTP/shell user is a “machine user” in their own right, and there is nothing about your initial FTP user that gives it any special “admin” privileges, other than file ownership of the files in that user directory (and/or the ability to run CGI programs as that user if so designated for a given domain).
If you are saying that, in your case, you FTP user shares the password with your “WebId” or “Control Panel user”, then that does not have to be that way; you can set them to be different passwords.
To me, as long as I protect my WebID password, I can ultimately control all the users on the account as I can change any/all passwords at any time.
For example, I could change my WebID password to something different than my FTP user, which would eliminate your initial concern (that FTP user would then be nothing different than the 2nd FTP user you established for your contractor.
Alternately, I could change my FTP user password to something temporary (for my use and that of my contractor) until the contractor’s work was done, and then change it back to the same as my WebID if I wanted.
Does that make any sense? Maybe reviewing the DH Wiki section on “Users” would be useful.