Lock BTC amount for a while
You're users are not in control of the private keys, so you do not need to lock them via the Bitcoin protocol. This is just a simple permission feature you should build into your system using a database. If a user "buys from you" then update a field in your database for that user, for example the database field could be called locked and then you would have it changed to true.  Then make sure that you build your system to check this field is false every time prior to withdrawal.