Yes in theory this is bad practice as it is picked up as spoofing if the receiving server checks the SPF record as you found.
Rather than having to setup email addresses on the server etc the best way is to use the ‘Reply to’ header which should allow you to set the correct ‘From’ address from a single registered email on your server and then set ‘Reply to’ whatever you want e.g a users email.
Having said that sometimes the receiving server isn’t setup correctly.
A while back I built a form to allow users to send letters to DEFRA as though it was from their email address. I correctly used our site email as the sender and used the ‘Reply to’ setting to set the users email. DEFRAs server wasn’t configured correctly so failed to use the ‘Reply to’ field. Instead i set the users email to the From address (bad practice) and it was all accepted without a problem, when it should have been rejected. But I had no other way of making it work.