User data vs remote-exec provisioner

I am bit confused so does my question is. As per my understanding , user data runs only once at the initial boot time of the server. lets say , I am creating a server and havent provided any user data. now if I want to install any packages I can follow two routes
1.ssh into the instance and installl the required packages
2.use remote-exec provisioner inside your resource block and provide necessary commands to install packages.

Is my understanding correct?

It is always preferred to use user data for initial setup of new EC2 instances. You can read this article for an explanation.