Its always best to only allow client apps to access Entity beans via a Session bean. This is known as the Session Facade pattern. However, in my personal experience, i have always prefered to let the Session bean return the Entity Bean's remote interface(s) as opposed to the home interfaces you may have proposed... I think this is a neater solution.
