Fail Safe Logic
We have same kind of requirement at our side and we have used inversion at card level or settings inside the function block, not logically(via external not gates). There is generally a parameter for Energised status. As a practice, you can do it both in card level or you should change the function block/Control module input settings to Normally energised..
For example, In reuse library you can do it either in Digital input tags "MB" (by changing its energised status(PNE) to true) or in the hardware level. they both will result in desired failsafe condition and is accepted. But using inverters in software is not a good idea though it will serve the purpose. The choice is yours.
This is a pretty common situation. Both of your suggested solutions are "fail safe" and produce the same result inside the PLC. Ultimately, it is the field connections (ie normally closed) that are providing the failsafe condition.
My preference is to program whatever will be most obvious to someone who is programming and troubleshooting the logic at a later stage. If the signal is called "stop" or "shutdown" then usually programmers and technicians expect this to be TRUE to stop the plant and you should invert the signal at the IO channel. If the signal is called "Permit" or "Not Stop" then programmers expect the value in the PLC to be FALSE to stop the plant and hence the invert can be done in the PLC logic.
Because it is not allways obvious during troubleshooting that a button is normally closed I would also usually recommend that signals are called "not stop" or "permit"
Also, do not forget to set the fail condition for the IO channel so that you receive the correct value in the PLC logic if the IO module or IO bus fails.