I have a to create local user for my web dev, so he will be able to restart Apache, run tomcat, have access to web root files, etc.
So far, I have been dealing with such thing by setting his uid as Apache uid.
Is it considered safe?
That's not the kind of thing I've seen done in years. Just give him access to run specific commands using sudo and keep the accounts as standard user accounts.