Should I prevent bad values or explain what's what's acceptable?
I find that neither A or B are singularly the correct answer, you need a little of both.
Why prevent bad values?
You know what pisses off a user... when you finish filling out a form, put away some information you wrote down, click "submit" and BAM error message saying your email was wrong, or password wasn't acceptable, or you skipped a required field, etc. As a developer you have to design your ux to assume your users are dumb as a bag of rocks.
Most of the times these mistakes are simply accidently fat fingering a key or not quite pressing a key down enough, etc. (honest mistakes)
Email address? If it's entered with no "@" put some red text next to it that says "A valid email is required" Why wait until I think I'm done and hit submit? (Don't clear the field out, that just pisses people off)
Why validate on the back end?
So we've made sure everything is on the up and up on the front end, why should I worry about the back end, shouldn't it all be handled by now? Yes it Should, but not necessarily. Good application design especially when considering any outside resource (webservice, user input, file system, database, etc) you want to assume that resource is volatile and dangerous (even if it's proven not to be)
Tons of reasons for this the backend could have multiple front end, bug prevention, security (primarily in limiting the scale of a compromise should you be victim to one), etc. This is the "trust no one" network mentality. Trust no one is typically inclusive of one's own resources as we all make mistakes and bugs happen, proper layered approach can prevent a minor bug in one place becoming a crippling bug on a large scale.
What I do
Generally I validate all user input on the front end as it happens, and prevent them from submitting at all (often through greying out the button with whatever's wrong nearby) then after it's sent I validate it in my business logic on the backend.
I do this because a lot of my input comes from multiple sources, some of which I personally oversee, others from third parties. Both of who I don't blindly trust. (that's right, I don't blindly trust myself. We all have good days and bad days.) I've not had a problem security wise, but I have had to slap third parties for sloppy validation. (which my backend validation caught)