I have a Linux (Ubuntu 16.04) computer, and I have to create a user that has sudo rights, but I still don't want it to be able to cause any harm remotely (I worry about stupidity, not malice).

Wouldn't this be fixed by not using that user remotely?

1) I have telnet disabled, is there any other way (besides SSH) that someone can access my machine remotely?

If you have installed other methods then sure. It really depends on what you have installed.

2) How can I restrict access? I understand that chroot is not good enough since the root user (or a sudo-able user) can just step out of it.

There are containers which are kind of like hardened chroots. Your root user inside the container shouldn't be able to escape out of it. Containers are a lot more lightweight than virtual machines.

3) Is it possible to route specific SSH logins into a VM?

One way I can think off the top of my head is to allow login with keys only and then making the key login just ssh into a VM or something. This wouldn't require a different ssh port for the VM and wouldn't be dependent on your client machine doing the proxying.

This would look something like this in the .ssh/authorized_keys file:

command="/usr/bin/ssh someuser@yourvm" YOURPUBLICKEYHERE

I'm sure someone will come up witha lot better solution

4) I know about Linux namespaces, but so far did not understand how they can help me with root problem.

It's easier to understand them by just playing with containers. I would recommend lxc, it should be available in most distros' repos.