The one specified on the device becomes the default for any DNs on that phone. If a CSS is specified within the DN, then that is used over the phone's CSS.
For example, we assign a restricted CSS on the visitor phones used by Extension Mobility users. If nobody is logged in, the phone is restricted. When an Extension Mobility user logs in, the less restricted CSS of the Extension Mobility's DN is used and allows the user to make long distance calls.
Our company assigns it by the device. That way we can control permission level based on the device itself and not the extension (assuming it's shared over multiple devices). You can pretty much go either way as long as one of them has the CSS, calls will go out.