XI Server Proxy Or Enterprise Service

I need to call a BAPI in R/3 using XI. Possible Approaches:

1) Using RFC Adapter : Performance Inferior (I do not want to discuss this)

2) Using Server Proxy and calling the BAPI inside the method.

3) Exposing the BAPI as ES and consuming that using XI.

Now when we compare the approaches 2 & 3,

what are the basic differences in terms of security and performance.