Enable SSH access for cwp user account

[become]

I try to give SSH access for one CWP user account.
I used Change Users Shell Access function but after edit and set any of the options
I can't login via ssh.
Which options is most secure.
Can user logged via SSH delete vhost or postfix config ??