How to pass information server - server?

Since filtering enabled, client cannot modify anything on the server, with few minor exceptions (his own avatar position for example). Unless you specifically allow clients to modify it on the server (through RemoteEvents or RemoteFunctions), _G is safe from exploits. Client has its own _G that is separate from client. If you are a paranoid, try to modify _G only in ServerScriptService or ServerStorage, as these are completely hidden from client.

Now to answer your question, _G is easiest way to achieve server to server. But you should really use BindableEvents instead, as you may have problems with synchronization (one script reads value, before that value is set). Best practice however is to structure your code to use ModuleScripts, avoiding situations where scripts need to communicate with each other at all. While sometimes unavoidable, less internal scripts communication, the better.