Both.
A VCA will work well as long as it has a manual bias knob. Using a VCA also means you can modulate the volume later if you choose. An ever so subtle amount of modulation can really bring some movement to a patch.
A simple attenuator can be very inexpensive and passive (requires no power). Koma makes patch cables with passive attenuators built-in. This may be a good solution if you don't want to commit rack-space to a passive attenuator.
Next up... units that offer attenuation and attenuverting. Sometimes you may want to attenuate a signal and even invert the phase of it. The Intellijel Quadratt is a nice set of four attenuverters that can offer some flexible control, mixing, and even static CV output (if nothing is plugged into the input).
Befaco makes a dual attenuverter that also features an offset control. A good example would be taking an LFO that goes from -2V to 2V and shifting it to 0V to 4V... then inverting and attenuating it to -2V to 0V.
These kind of boring modules can really make all the difference in your patches so I'd research your options and needs.