I have a grails application that uses your second option.
There is a separate module for data processing, because in this project there are two different stand-alone applications (Grails server and server processor with REST api), and it also uses MongoDB (so all this GORM magic does not help there).
And Spring Security, used on both sides (network and backend), with various implementations, but everything works fine. Actually, this requires some small work to implement the required beans (see Spring Security Core Plugin), but it is not that difficult.
source
share