There is no password on the user account, meaning it has no valid password. You would actually be decreasing security by adding a password for user.

As has been suggested, change the root password and optionally disable the root login entirely so that root is no longer available for remote login - in theory someone could enter the password using a brute force attack, although it's very unlikely.

Only use ssh public/private keys (ie. non-password authentication) to login to user and then sudo to root when required.