This depends strongly on your application. The web approach maybe more comfortable for the user but will put you and your application in certain responsibilities and risks. From my understanding you have at least this three possibilities.
Possibilities:
Web Only
If you are running a pure Web-Portal like an Exchange this maybe the way to go. You would kind of provide the wallet for the user. But this has some security issues. If your db gets hacked or your system somehow infiltrated (steal, delete) your user can loose everything related to that keys and this would be your fault. As a crypto user I would personally have some concerns using a new plattform and expose or generate keys there when desktop tools are available.
Locally Stored
Another use case could be an application that stores the information locally (like the greymass vote tool) or some docker bundled application that includes the eosio CLI tools. Advantage of this solution is, that the user is responsible for his actions and you do not have the store all user keys centralized.
Permission System
Third option is to use the EOS Permission system. Users could add a special permission for your smart contracts. So they can sign transactions with their regular keys and would accept actions that are signed by your contracts account. Also users can remove permissions anytime they want and are not stuck with potential accounts that use their token for RAM.
My Opinion:
Personally I would go with the third option because this is the cleanest version and has major advantages. But like I mentioned before it depends on your use case.
###Additional Read:
- Maybe the eosjs library is interesting for your use case.
- Also the RPC documentaion could be worth a look.
- There are also a few Tools that give the user build in functionalities like Scatter.