Rich’s point was that you shouldn’t grant a user the ability to do anything it wants, no matter how limited the risk is. I’m inclined to agree.
I wrote a guide for using OH to reboot or shut down an RPi, but it’s for the Pi that OH is on. However, I suspect that the permissions you need on your remote Pi are the same.
# Allow openhab user to execute reboot and poweroff commands
openhab ALL=(ALL) NOPASSWD: /sbin/reboot, /sbin/poweroff
Note that this won’t solve your “SSH into another Pi” problem, but it might get you a step closer to the overall solution.