The big different between Auth0.js and Lock is that Lock also provides you with an UI while Auth0.js is just logic. Both can then be used for embedded login (in the application itself) or centralized login through the hosted page.
For simplicity and added security the recommendation is to go through the hosted login page.