From a security standpoint, it's almost never a good idea to make it possible for a system user (like www-data) to login remotely.
Instead, create a new user specifically to own your Wordpress files. Make www-data the primary group for your user, so that all files you create will be group-owned by the www-data group. As long as your umask is not too restrictive, any files you create as this user should be readable by the www-data group, and thus also visible to the web server.
Finally, I would recommend against using FTP (for a couple of reasons, security being biggest), and instead use SFTP, SCP, or rsync-over-ssh.