I assume you mean cardano-wallet API? Yea - unless you just have few hundred/thousand users , your use case sounds like second part will be more suitable instead
Not really, as mentioned in later half of my reply, you could derive addresses from root keys and just maintain a user mapping against derivation IDs too. This also allows you to use enterprise addresses, wherein one address cannot be linked to another, yet they all derive from same root.