I think, the best way to handle this would be to actually add the new item to user's roster but never send the item to a client as a response to roster get request. So, all the existing storage and logic could be preserved with a small change of excluding such items when a roster result is created for a client.

Applied in changeset commit:tigase-server|2eb9b8d0.

Items with SubscriptionType.none_pending_in are no longer included in the roster returned to the user. As for the security consideration -- I think it mostly relates to avoid broadcasting presence/probes to such contacts, but Tigase handles those differently and already took into consideration presence/transition state to avoid implied security problems, hence this was mostly cosmetic change.