Clone your site before he begins

Or let him work on another, similar WP site... once finished you can move it.

As long as you have access to your hosting panel, nobody can lock you out from your site, as you can always go to your phpMyAdmin and reset the admin user password or delete his user...

-Mohsin

He doesn't need more than ftp and a wordpress admin access. Delete the users and passwords when they're finished.

Do a complete backup and let him have access.

Change your admin login name and password when he is finished, and make sure the email addresses are correct for any admin accounts.

Use a scanner when they are done such as the one included with Wordfence to check for any possible landmines left befind.