I've just tested it and confirmed 100% it works. Here's the setup:

123-Reg (mydomain.co.uk) nameservers point to my usual CPanel nameservers
In my hosting management (I have a reseller account, so outside of CPanel) I added the following DNS records

exch.mydomain.co.uk NS ns1.afraid.org
exch.mydomain.co.uk NS ns2.afraid.org

Then, in afraid.org I added a domain called exch.mydomain.co.uk (So note that afraid.org never gets to know about the top domain) and added records as I required.

So exch.mydomain.co.uk currently returns 4.2.2.2 which I've only set in afraid.org

Hope that makes some sense! 

Oh, nice that makes sense. So it is definitely possible with access to the zone file.

Which I don't have access to since I only have a basic plan, and I don't think it's possible via the Advanced DNS Zone Editor either (I can only use the Basic DNS Zone Editor currently). Thanks for looking into this!

Nah, the advanced one doesn't let you do NS records either. You're welcome an account on my hosting though, and I'll create your NS records.