It's certainly possible to do it using the first way. Since you can decode the JWT in Express to extract some user details, you could use that to pull in the other details you need to generate the PDF, from the database.
The second way would perhaps be more secure, but you might find yourself limited if you ever need to add more functionality to the app as you'll have to update both the React app and the Express server.