The problem with adding a resistor is power dissipation.
I would recommend PWM. The controller mentioned in the original post looks reasonable. Leave it unbridged for 5V to 35V operation.
It's true there can be voltage spikes, but the battery should take care of them. Yes, if the battery is disconnected, when the engine is running, then there can be high voltages, but as long as that doesn't happen, then it'll be fine. That controller is cheap enough, that even if it does blow up, it's no big deal. Once you've got one and confirm it works, buy a couple spare. It already has a fuse, but you might want to add another fuse, closer to the battery.