Typically, RunService is not exactly the best way (at least in my experience) however there are tutorials on using it properly: Properly using RunService along with preventing Memory Leaks
In my experience, I have found it much faster when it is handled on the client side. I believe the second choice is more faster, as it requires replication on only the client’s side. This leads to less performance issues on the client’s side. However, keep in mind of exploiters as it is easier to exploit into a client-side system.
I suppose whichever one makes the best sense: if you want more security, go with the first option; if you want improved performance, go with the second option.