It is always advised to set all important security rules using Entity Access. This is always checked on the server and can't be circumvented.
I'm not sure how you want to implement the data source dataview with dummy associations but this in and of itself shouldn't be too much of a performance problem. The java action (if external) would most likely be the heaviest, and I think that's the only real thing you always have to do.
Cleaning up the associations could be done using either a scheduled event or the Microflow Timer (keeping it alive whilst the user is on the form).
Thanks. I will do some tests. Would it be possible to create a custom datagrid that would remove the need to create the temporary associations and use the java action data directly?