I have users on IE9 who cannot see my custom fonts. First I thought it was a CORS issue, but after some experimentation I believe it is because the security settings are such that IE will not allow any third-party content under any circumstance (this is on a massive conservative enterprise network of managed computers).
This might also be an issue on newer versions of IE set to "high" security, I'm not sure.
So I think the best solution is to serve fonts directly from my domain for IE users, instead of from the CDN.
Here's a way to do it with conditional comments. I don't know how your fonts and other styles are organized, but you'll probably want to use
<!--[if IE 9]>
stylesheet using internally served fonts
<![endif]-->
and maybe
<!--[if !IE]> -->
stylesheet using CDN
<!-- <![endif]-->
The latter will apply not only to non-IE browsers but also to IE10 and up, but you might only need to use the former.
To answer your first question, I prefer using fonts from my own servers when in production. Cuts down on the number of moving parts and means that my site doesn't rely on another site.