I saw that, currently, we use a custom ajax controller to trigger commands on the server's side, but it might actually be better to use the REST weapi (architecturally-wise, mind you, as it's perfectly fine as it is right now).
M2 favours such stuff via already-made webapi.xml definitions and JS ajax libs made for it, ACLs etc.
One other small but important advantage would be for new developers already familiar with the webapi, not being forced to create custom controllers, but go the usual route, via REST controllers (which every M2 dev should already know).