Best practices IMO is to never store AR or any type of complex objects
in your session,and use hidden fields sparingly as a last resort.
Just use AR and validations. It takes a bit of time to learn enough
AR to know how to structure things, but it's worth it because that one
investment in time will make your life much easier from there on out.
For instance you can use update_attribute to save without validation,
or use custom validations. You could for instance have an attribute
in your model that determines what validations are performed based on
it's value, etc..