Is it possible to allow another dynu account (user) to be able to manage records for one of the DDNS domains on my own account and still maintain control and access revocation over the DDNS domain?

Basically I'm looking for basic access management controls for specific DDNS domains.

Can we do it through domain delegation, API keys (that don't give access outside of that DDNS domain), through the cPanel, or in another way?

What about zone forwarding? Can that be used to create such a setup?