I use a mix of both. GraphQL is used to validate the schema and types of the input, model validations are used to ensure that the actual values being saved to the database make sense from a domain perspective.