If you have decided to use EJB, then the how and where is probably Container Managed Transactions from the EJB. I'm sure you will be aware of this too, but make sure you use a mydsql database engine which supports transactions because not all do.
Remember that Hibernate/JDBC transactions are different from JTA transactions. If you are calling your Hibernate code from inside a CMT EJB method, you won't use the Hibernate transaction API directly at all. Typically Hibernate recommend a "Session per business (JTA) transaction" approach. This basically means when you call your DAO code from a business method it opens a session, and does a bunch of persistance stuff (possibly accross many DAO's). At this point you are working against the session, not the database. When the last persistance operation of your CMT method finishes, the session is flushed and closed. If you wan't to roll back any of the Hibernate operations which happened in this CMT you do it just as you would for any CMT method; the presence of Hibernate doesn't make a difference.