Let me make a couple of suggestions that may or may not work, but let me throw them out there.
Unfortunately as you have seen from previous posts, what we call in my world, multi tenancy or row level locking, ST hasn’t implemented anything like this for multiple accounts to assign or allow access configuration to different accounts.
With that, If you were to install webCoRE and webCoRE Presence Sensor (fairly new), there wouldn’t be any need for you to install the SmartThings App on his / her phone. That’s one problem averted. And the system would arm / disarm without any need for accessing SHM or critical parts of your ST environment.
Then, with Action Tiles, if she had a guest account and you created a Panel just for him / her that only allows them access to a small specific set of devices that he or she can turn on or off, or a specific set of Routines that can be run, setting a specific Mode, etc. and then of you want to revoke something at any time, you could pin protect those specific tiles or remove a tile or remove the panel entirely if you fired that person.
Is it possible that this would cover your use cases satisfactorily?