Dan, giving permissions to other servers is not something related to the Pump.io federation, is only a detail of how the web interface works.

Using a client like Pumpa or Dianara you can follow anyone without ever giving those permissions.

I seriously recommend you check out the clients =)