The idea was to store the encrypted number of tokens,and when user was sending his private key, smart-contract would decrypt the data and perform an action of sending tokens to someone else. The catch is, user doesn't have his own ethereum address, so I need another private key generated for this and everything will be performed by one account from back-end. Also this will be one-time action - once private key sent and tokens released there will be no need for this private key anymore, so it's ok for it to be exposed to public chain.
I've found the only solution is to encrypt off-chain, keep it in smart-contract and for someone to read it there and decrypt again off-chain, but I need to perform an action after this so it doesn't fit here.
Hope for any suggestions, thanks.