There is some value to getting the set of forms the user can access, as that is just one round trip to the DB per user. That may or may not cause issues, depending on whether the user could change in mid stream. However, a single scalar query is so fast and light as to barely matter, so it largely comes down to what is easier.

A third option is to give every user a roll. They could get their roll upon startup. Every form would then be able to decide whether they can be shown to a user in that roll. That would mean that the DB would hold perhaps just an integer per user, and the forms wouldn't have to be stored anywhere, as each form could know that if the user in rull R, they are okay, otherwise they are not.