How come every 2nd "helpful" post over here is made by someone who hasn't got a clue what they're talking about?
Just so you know - when you grand someone guest access to your GA you're not "blocking" them from seeing any sites. You're GRANTING them access to a particular site / sites and not only will they not see the URLs of your other sites, they won't even know that other sites exist in your account.
Don't do PayPal. Or if you do then make an agreement saying that you will hold the domain name for 45 days after the payment (as that's the deadline for opening a dispute). Escrow.com is only slightly more expensive but 100x safer.
But you should obviously still do your due diligence on the buyer. Google their name, get them on phone, etc. .. in short, make sure that they seem legit. Scammers often enough look/sound like scammers, generally avoid phone conversations etc. etc.