I agree with Erik's Erland's suggestion #3 too. Having the user create the stored procedure in a different schema sounds to be the way to go. I'll do some testing with that and let you know how it goes.

Thanks guys for helping me out.

This situation is one where testing saved the day: i was just sure that the user permissions were what I was expecting. This could have been a significant "whoops" had it not been for testing.