Well, I am not sure that there are any best practices for this, just what works best for you and your situation. I have APM unlimited licensing so that isn't a limiting factor for me; however, I still choose to use the Log Forwarder & Log Matching solution more often. I like the Log Forwarder because I can then show the last few logs for each node on the node details page to aid in troubleshooting.
If you use the Log Forwarding method you should read my comments on Re: Orion Syslog Load for some best practices on setup/configuration.
Hope this helps!