Read the fine print and/or ask your host. Shared hosting is physically set up by userspace, not by domain name. So you need to add your freelancer as a user.

Details will depend on the host. But for several years I did something similar to what you're describing: one of my directories-- it's easier if it's a whole directory-- was aliased to my son's userspace. That means he could edit the files and upload new material. If I logged on as myself, I didn't see that directory. If I logged on as him, I saw only that directory. Users visiting the site had no idea that this one directory was physically in a completely different place. Links behaved normally. (If you had your own server, you would have to Do Things to make this happen. The host probably just clicks a button and things magically get added to the config file.)

The downside is that you have to maintain two separate htaccess files, one for each of you, because htaccess goes by physical location, not domain name.

When you give them cPanel access, you're giving them access to everything, no way around that.

You could buy a separate shared account (probably cheap) at your webhost for the WP site to be installed and customized, and then transfer the files, database, and settings to your live site after they're done (not really as easy as it sounds).

Or don't hire people you don't trust.