You will most likely need to run an implementation of an etherum node that accepts
RPC calls. The specific calls you will have to make in order to create/sign a transaction will depend on the client implementation you are running.
Depending on the values involved, you may also consider crediting tokens to a database balance for the user, and allowing the user to withdraw upon certain criteria being met. Anytime you move a token to a user's ETH address/"wallet", you will have to pay a gas fee.