Best practices IMO is to never store AR or any type of complex objects in your session,and use hidden fields sparingly as a last resort. Just use AR and validations. It takes a bit of time to learn enough AR to know how to structure things, but it's worth it because that one investment in time will make your life much easier from there on out. For instance you can use update_attribute to save without validation, or use custom validations. You could for instance have an attribute in your model that determines what validations are performed based on it's value, etc..
Chris