I believe it can be done without any XDS.
all you need to do following
1) for each security y role remove delete permission. you can do this easily by Security Development Tool
2) create a privilege only for purpose of 'Deleting SO'
3) create a new role and drag privilege (#2) to this newly created role(#3)
4) assign this role(#3) to the user