TL;DR - They are safe to use, but, it depends in the configuration and implementation of your solution (as you noted - the dhcp binding table could become a problem, since IP source guard and ARP Inspection are relying on it).
DHCP Snooping with ARP Inspection
ARP Inspection and DHCP Snooping are great combination together ("supercouple").
As long as you whitelist the trusted ports in your switch, use ARP Inspection (that will prevent MAC spoofing) and correct static DHCP binding table, you will be pretty safe.
Why is that?
- ARP Inspection will keep that no one could spoof his MAC
- DHCP binding table - the ARP Inspection uses the DHCP binding table, by validating the MAC and the
- Whitelist the trusted ports will keep the devices under the switch safe from other machines that are trying to pretend as DHCP servers
DHCP binding table and IP Source Guard
Just as with the ARP Inspection, also this solution relies on the DHCP binding table.
- If you have a lot of "temp" users in the network, use a short lease in your binding table (as you have mentioned, the table is limited)
- In order to use ARPI or IP Guard, you have to activate the DHCP snooping (and in general, use all three of them together).