How to add a second user with SSH access to my Ubuntu PC running Bitcoin Core? I have a friend who is interested in learning Bitcoin CLI, and I told him I would look into giving him access to my node - in a non-destructive way - perhaps testnet only ?

Totally trust this person, we work together closely on many projects, and he's interested in learning about the network but doesn't have the means to set up a full node himself. I tried lots of searching but couldn't find a clear response.

I want to preserve the integrity of my node, not give him access to my user account, but let him use it for educational purposes.

Any kind souls have a guide on this process?
You don't need to grant someone access to the entire machine to be able to use bitcoin-cli. You can provision credentials using the rpcauth parameter in bitcoin.conf (it may be defined multiple times for multiple username/password combinations), and whitelist their IP address for the port you are running the bitcoin RPC on.

They can then use a local bitcoin-cli binary along with the -rpcport and -rpcconnect options to use a remote bitcoind instance.

Naturally, you should avoid leaving unlocked wallets on this server, as anyone with RPC access may spend your coins. It should be treated as a read only instance.