I've always been taught the pass rules are more efficient, simply because on a correct match the entire traffic stream is ignored.
To quote support: You can create pass rules to prevent packets that meet criteria defined in the pass rule from triggering the alert rule in specific situations, rather than disabling the alert rule. By default, pass rules override alert rules.
Though you should be careful, if you have a pass rule that matches an alert rule, but you wanted a few IP address exclusions - if the alert rule changes you're the one who needs to remember to update your pass rule.
