Region3s don’t seem ideal since they can’t be rotated at all, but whatever works best I suppose.
I recommend client-sided but verify on the server that they were close enough and that they were attacking and possibly even facing roughly the correct direction. Most hackers won’t be trying to add a single stud to their hitbox, and even if they did it would still take a degree of skill to get advantage out of it, which is something most hackers won’t have for a given specific game. Latency is crucial in melee, so I would favor this course.