I'd look very closely to putting a cap on the max records that they can pull. If they really need 20000 records, then maybe it should be a report! As far as performance goes you'd be hard pressed to do better than DataReader. To filter out downloading unwanted columns, you'd have to do dynamic SQL, which could lead to security risks and worse performance due to compile on demand for the SP on the database.

So, I'd push for a records cap and if that's not possible, I'd look into background threading the data retrieval process, so at least your app is responsive. . .