so basically through xpriv i can get new address and it can be use to withdraw payments and for security of users accounts
You cannot receive Bitcoin directly to an xpub. You use the xpub to derive new addresses which you use to receive Bitcoin. However, Bitcoin Core uses hardened xpub keys so you can only derive addresses by using the xpriv to derive the private key and then get the address from that.