If the users need INSERT/UPDATE/DELETE permissions, is Windows auth still more secure than SQL Server auth?
In my view Windows Authentication is still more secure.  Just.

With windows authentication you can allow a group of people (via a Windows Group) to have access to the database.  Only those users can use an application, any application, to connect to the database.

If you use a SQL Server account then anyone who knows the credentials (and invariably these always leak out) can connect to your database.  Again with any application.

You are absolutely correct that with Windows authentication can connect directly to the database and issue any query they see fit - due to the model your app requires.

A third option

What I would suggest in this situation is the use of an application role: http://msdn.microsoft.com/en-us/library/ms190998.aspx

The problem you have here is you have to be able to code the application to be able to use the application role - that's not always easy.  Afraid I'm not an Access expert to be able to advise here specifically.

The advantage of an application role is that you can restrict which applications can perform certain commands.  Its similar to a database role but has a password assigned to it that is needed before the rights of the role can be inherited.  Using an application role with a Windows group you could limit the users who can connect to a database and the application that they can use to query the database.