ERC20 has a function called
approve(address _spender, uint _value) which allows a user to give permission to your address or contract (
_spender) to debit your token up to the specified amount (
_value). Once approved, you can transfer funds on their behalf using
So have your user approve a single transaction in Metamask giving your address or contract permission to debit their funds, then you can perform any future operations on their behalf without them needing to approve another transaction through Metamask.
Note that you will still need to somehow get a transaction to the network to debit these funds; The obvious way to do it would be to run a server-side process listening for user actions, somehow validating that they really came from the user in question and sending transactions for them behind the scenes.
PS. If the user is going to be clearing you to debit funds used in many small transactions in any case, you may also want to look at different approaches, in particular state channels, which don't require either them or you to keep sending transactions to the blockchain. For example, see this proposal for fast, verifiable off-chain gambling.