Orion is just an http service, so everything that you can use to protect http services is fine.
The best solution depends on your deployment scheme.
Within FIWARE you have the two that you mentioned:
- Wilma, very simple, works with Keystone;
- Steelskin, more advanced, works with Keystone or Openstack Keyrock.
Other options may include:
- nginx, is typically used as a performant proxy and has authentication modules as well;
- Squid, is a widespread proxy and also supports authentication;
- Apache, has widespread proxy and authentication modules, although it will probably be the bottleneck of the system.