yes those are your only options. you can override the main appSettings from user.config so typically your production site would have a different user.config file with its own connection string and you would not deploy the user.config file from your dev environment when publishing.