A special private key that can be used to make a TX to a certain wallet ONLY

I want to be able to achive this:

• a private key or its substitute (P) of a user wallet is stored on a server

• there're 100s of user wallets there, so there're 100s of (P) too

• let's say, it's ETH, SOL or any other major network

• server isn't a safe environment, as it's known

• there's also a main, admin wallet (M), in cold, local storage

• (P) must only be used to send outbound TXs to (M). Not anywhere else

This can't be achived with a normal private key, right? But how, if at all, it can be archived? Multisignature wallets?

The goal is automate withdrawals from the user wallets on a server, to make the process safer.

I don't consider any third-party solutions.

I'm a developer