I think the trick is perhaps to have limited responsibility for the faux-NPC's actions but also have limited benefit. For example, if would be bad if online players could farm faux-NPCs for loot or XP. It would also be bad if the faux-NPC got itself killed many times or used all your potions. Maybe they never use expendable goods, and there's no/little/capped benefit to players killing them? Similarly no/little/capped downside if they get killed. And you only get a little XP from their actions, e.g. 30% normal. But for being a merchant etc, sure. They sell what you allow to who you allow.
Players can not remove gear from faux NPCs. Also there is a permissions list of who can even use your character. You can also set whether the other player is allowed to trigger potions. They could always use their own potions on you.
Players get the correct amount of combat experience from creatures based on % of damage dealt.