SSH: You'll still have to log on to SSH first, no? So either you chroot that SSH access to a specific directory and the problem doesn't occur, or you don't and you give the user access anyway.
Sure, but OpenSSH does not allow this AFAIK.
Or can you somehow force him / her to only use that SSH connection to subsequently start an FTP session over it?
I don't understand this.