What you are describing for your brothers use is not a subdomain at all, it is a full website like your own. It's great that DreamHost allows you to host as many such domains as you want for no additional hosting charge (you still need to pay for the domain registration for the additional domain(s) ).
You can also save the money for a new domain registration by using a subdomain for your brothers account. This would be something like "brothersdomain.mydomain.com", in your example, or whateveryouwant.dreamhosters.com, or similar for any domain you already host (the dreamhosters.com domain is reserved specifically for this use, so you don'thave to use your won domain if you do not want).
Either way, you don't need to make this a folder (directory) under you own domain name on DreamHost. You can (and should) "Add a domain or subdomain" from the control panel for this new site. When you do this, DreamHost will create a directory for that site in the user area of the user you selected to "run" the site (the panel will ask you at domain creation time).
If you create a new user for your brother, then his site will be in a completely different area than yours (you could still "see" what is going on in there by just using his login/password) or, if you feel comfortable, you could just create the site as your own user, and share your credentials with him (you could both see/work on either site).
The "extra security" doesn't really work the way you are envisioning it (though users and permissions are involved) . If you actually want to allow him "direct access to "his" website", either method described above will work.
In the first method (your brother is his own user), then he could have direct access to *only his site* (you could still oversee it, because as master account holder you could just share his credentials or, if need be, change his password to allow you access in an given circumstance).
In the second case (running his site under *your* user, he can either share your credentials or, if you don't want him to have direct access to both sites, you could only allow him administrative access through a "filemanager" type script or a Content Management System (like the one-click Joomla!or WordPress installations), and just not allow him direct FTP access (I do this for some of my family members).
Edit: OOPS! I had the thread collapsed and somehow missed the previous responses ... that way works too, and I'm glad you got it sorted! 
--rlparkerEdited by rlparker on 12/04/07 05:47 PM (server time).