Why are you creating a new user if you just want your friend to be able to host a webpage? For that, all you need is to give him FTP access.
You will want to set up an FTP server, create an FTP user called
joris and then let him upload his files which will then be served by your HTTP server. You can then make sure that
joris can only access the folders you allow him to but that is easy with FTP. You just need to configure your HTTP server so that it serves the directory where
joris will be uploading his stuff. There is absolutely no reason to create a regular Unix user for him.
As for whether it is normal, yes it is. Unix and Linux permissions are usually all about write access. In most cases, allowing people to read is not a problem, the security risk is allowing people to write or delete.