I haven't done this myself, but if I were going to do it, I'd use extended events. The trick is going to be filtering by a particular user. If you use application logins instead of individual logins for connecting to the database, I'm not sure how to identify the user. However, tracking for a particular login and capturing their query metrics and those queries cpu & io metrics, is all pretty straightforward using extended events. You'll have to capture rpc_completed and sql_batch_completed events. Then add a filter on them for the login you're interested in. After that, aggregate the data.