How to ringfence php access to a specific folder

hi,
I'm learning and doing some dev work on a bluehost server. If i give ftp access to someone to a specific folder, it seems they can access other parts of the server outside of that folder by using php.

What steps do I need to take to ringfence that activity and restrict it to one folder (and it's subfolders)?

Many thanks