Consider: Trust, reputation, references, and proof of competency.
Technical:
1st Method:
Steps:
1.) Clone your site and deploy.
2.) Only keep plugins, files, and content related to work. Remove everything else.
3.) Create separate ftp account for new directory.
The above depends on your skill set. But addresses your concerns. I do this as a common practice for the past five years. I have had zero issues.
2nd Method:
Backup, download, have a recovery plan, prove the recovery plan works. Then prepare for the worse - theft, spyware, site deleted. Then give access.
When in doubt:
Read, Ask, Do.
G+