What is the best way to maintain addresses for my clients on my mobile application?

Hi, I have a mobile application where my users/clients can deposit money and then we maintain their money for them (investment, etc.) and withdraw as needed.

We don’t want to use any bank deposits here. We want users to send crypto directly to us.

What is the best way to achieve this? Do we have to create unique deposit addresses for each user (afraid of maintaining private keys here) Or can I create a smart contract to maintain ledger of what each user deposited and ask users to directly send money to this smart contract (although I don’t plan to say they are sending it to smart contract. Smart contract is only for my internal purposes to maintain secure ledger)

Or any other suggestions or 3rd party tools that can help me are welcomed.

I want the process to be very secure and easy to manage for very small team (2-3 members)