Use the second approach. The problem with using information like account numbers as your primary key is that they can in theory change (yes, even if the client says right now they won't ever change). Stick with the id field that uniquely identifies the database row.
In the comment thread you clarified that the database belongs to service B and is managed by you.
This gives you the authority to control access to the database. This does mean you have to expose an endpoint and route this traffic through your service, but it also gives you the authority to throttle requests as you see fit.
If you draw the line at ...
Both the saga and unit of work patterns intend to ensure consistency of related operations, but at different levels:
The saga pattern aims at ensuring consistency across independent services and without using a two phase commit.
The unit of work pattern aims at ensuring consistency (usually within a system) by making sure that the object states and the ...