Hi @SvenMeyer,
If depends if your participants are using your app or whether they are interacting directly via the contract.
I assume your buyTokens() would be fine as you are then calling the non reentrant buyTokens(address) (as is done by the fallback), though I would appropriately test and audited as part of your solution.
You could use the fallback, as long as enough gas is provided.
If it is a concern that users will provide an invalid beneficiary, then you could enforce this restriction using _preValidatePurchase
As you are creating a crowdsale, I recommend looking at: Points to consider when creating a fungible token (ERC20, ERC777)