You can give someone a NWC connection with only make_invoice permissions. LNURL is not needed