Authentication method for web app

Hi all,

we're going to deploy a web app that manages users/roles for another
application.

We want the database to be "safe" from changes made by malicious
users.

I guess our options are:

1) have the db listen only on local connections; basically when the
machine is accessed the db could be "compromised". Hardening the
server access is the only true security defense we have.

2) Use, as user/password, the same user/password used to
enter the web app. Basically there would be a 1 to 1 matching between
our app users (and password...) and the db users (with proper
permissions...)

I'm not a great expert on these things (as you've already guessed...).

Can someone help me?

Thank you