ESXi but I can't really give this person access to the whole ESX environment so I'd be looking for another way if possible.
You can restrict the user access only to the VM operations by setting the roles and permissions in the VI client. This way you can restrict the user meddling with your ESX box