defined('BASEPATH') OR exit('No direct script access allowed');

The line exists to make sure the file is being used in a CodeIgniter environment. So I'd say the answer is it goes in any file where that is true. Controllers, Models and most other files that define a "class" would probably fit that description. Perhaps in views if they use CI classes, otherwise it's not necessary.

Perfect answer, that's clear, thank you.

I'm still wondering why this line is mandatory. I don't see any security breach if the line is not added. 

How could a malicious user access to something ? PHP script will return an empty page and classes or functions can't be called from an external website. Am I missing something ?