incrediBILL - 7:14 am on Nov 24, 2012 (gmt 0)

[httpd.apache.org...]

Note that all Allow and Deny directives are processed, unlike a typical firewall, where only the first match is used. The last match is effective (also unlike a typical firewall). Additionally, the order in which lines appear in the configuration files is not significant -- all Allow lines are processed as one group, all Deny lines are considered as another, and the default state is considered by itself.

This little tidbit, if it works as documented, would imply that a very large list could be really slow UNLESS it's preprocessed, cached and indexed at which point it would be very fast and a moot point.

Again, performance testing appears to be appropriate with either method.