Code protection in External flash
Well first of all: You've chosen the wrong chip for the job. If your this paranoid into securing your application code, you should get a chip that:
- supports storing crypto codes. (special masking layer is required for this)
- supports execution from encrypted memory. (special memory bus required)

But at least you can try:
Method 1 has most balance between secure and effort. However, it will add boot time since you don't have hardware accelerated crypto.
It's not hard to deploy, but it won't give absolute security. You'll need to store the decryption key on the same board.
Encrypt each device with a new random key. Don't base your key on the ID.

When anyone looks at the dissembler of the bootloader, it will be obvious where the key comes from. Make sure the key is gone when someone is looking at the bootloader.
This will get you more returned devices.

Method 2 is hard to deploy. It could require you to distribute your objects to any subcontractor doing assembly and testing.
However, you can't prevent anyone who really wants to have the code to read it.
And anyone looking into the dissembler can easily remove the instructions since the ID locations are known.