The correct answer to this is that you really can't.
There are several ways to approximate the solution you describe, but no way no be 100% sure. There is an adage in the security world that physical access is 75%* of the game. This is great case study far why that is true.
The scenario you describe and the solution you think you are looking for will, for all practical purposes, work most of the time. You'll have made it very difficult for either user to compromise the other. But difficult is different than impossible.
No matter what you do to each partition and the software in it, you do not change the fact that at some point the other user is going to come along and decrypt their own partition and run their own software. With physical access to the machine and the low level software environment on it, it is possible to compromise the system.
The theoretical problem here is the same as that of a virtualization scenario with a host and a guest. As a guest operating system, you should never assume that your box is completely independent from the host. You may not be able to compromise the host but the host can almost certainly compromise you. If you don't trust your host machine, you guest should not be trusted either.
Back to your scenario. Although you are not using virtualization, the effect is roughly the same. Both User A and User B have bare metal access and can put themselves in the role of the host. All they need to do to compromise the other is play a few tricks on the other partition and OS so that it inadvertently plays the role of a guest.
The most obvious way to do this would be to compromise the bootloader with a rootkit. Other attack vectors come to mind as well, but tho long and the short of it is that you should NEVER assume that hardware under full control of another user and software environment can be used un-modified without potentially compromising yourself.
The solution here would most likely be to give neither A nor B access to bare metal and give them both a side by side guest environment. Assuming neither of them are given access to the host. This would be a more secure way to go. (Not perfect as it relies on the quality of your virtualization system, but it's better that knowing your bare metal is being used by another host).
Pragmatically speaking there is rarely a case where a virtual machine cannot do what you need it to do including giving access to card readers or other hardware devices. In the rare case where that is not the case, you will need to separate your environments the only fashioned way: physically. If User A and User B don't trust each-other and both need low level access to hardware, then give them each their own hardware already!
* Where the exact percentage is some random high number made up on the spot.