I'm not clear about your web app, like will the user be sending XMR or receiving XMR? I'm assuming they will be sending, so maybe just have one exchange address that your backend service uses and then assign payment Id to each user. Then they don't have to see any address, just a payment Id. A stable exchange like Bittrix are up 24x7 and pretty secure. A drawback is paying an extra fee if/when you move it to your own wallet. But if/when you cash out you need an exchange so keeping it there would be a wash then (fee wise).