Hi James and welcome to our forum!
The two methods you list are both valid - a) use a secondary data source to query info for auto-population purposes, and b) create a Web service layer on top of your database that generates an XML that is InfoPath compliant.
Obviously, the first approach is faster for the reasons you mention, but it lacks support for permissions. Do you care about what your users can see? Will you just assume everyone can read everything or do you want to authenticate users? To implement permissions will take some work. Assuming everyone can read everything, it will be easier, but is often not what people need. Finally, if the users have to submit the resulting forms to the DB, you need to worry about write permissions as well and locking if they are editing existing forms.
The second approach is more time consuming but ultimately more flexible as it provides a layer of abstraction. This is the approach we take with our Database Accelerator Web service product. We solve the format issues but we don't read directly from the relational schema - instead, we store both files and data in the DB and read from the files for easier roundtripping and better data fidelity. We also have a Web service that supports easy enumeration of data for pre-population purposes that we often use on top of the Database Accelerator.
If you'd like to try our Version 2 beta, let me know and I can send you a copy.
Regards,
Patrick Halstead
Project Manager at Qdabra