Your ideal solution here is to generate the private keys (and calculate the corresponding address) on the client side, and only import the address into the node running behind the web application using the importaddress command.
Then use createrawsendfrom to prepare transactions for signing on the server side, and pass them to the client side for actual signing with the private key, before they go back to the server side for sending with sendrawtransaction. So the private keys stays on the client side.
You will find various JavaScript libraries built that can do this for bitcoin, and these can be used immediately with MultiChain if you set up bitcoin-compatible addressing as described here: https://www.multichain.com/developers/address-key-format/
More on external key management: https://www.multichain.com/developers/external-key-management/