This is actually a quite strange situation.
Ordinarily, the advice would be, "Apply wherever you want - until you have a signed offer, there's no reason to stop applying places."
But, this gets really weird in your situation. First up, the two potential positions aren't really different - they're ultimately doing work for the same main company. So one analogy would be "It's like a company had two different departments hiring for 'Senior Developer' - you'd be working for the company either way, it's just a question of who your boss is." Except, in your case, it might literally be the same job/position (just whether you'd be working through a 3rd party consultancy.)
... but then it gets thrown into even crazier waters. Because Tim (you didn't give them a name, so I'll make one up) has a really terrible conflict of interest here. From what you've indicated, Tim is:
- Hired by MegaCorp as an individual employee. Which means Tim has an obligation to not act against the interests of his employer.
- Runs TimCo as a 3rd party consultant firm, which may or may not have MegaCorp as a client. Which means Tim has an interest in hiring employees for his firm.
I'd say Tim is being at least a little bit shady right now. Chances are, they've just tried to dissuade you from applying to Megacorp in order to try to poach you into their individual firm.
But... it's not as simple as saying, "Apply to both! Don't let Tim funnel you."
... because it's also possible that Megacorp doesn't have individual employees that do what you do - that they subcontract it out. In which case, applying to Megacorp might result in Megacorp forwarding on your application on to the subcontractor - which means Tim will get an email informing him that you didn't listen to them and also applied to Megacorp.
Send an email to Megacorp, asking if they do in-house work on whatever your field is, or if they subcontract it out of house.
If they indicate they do some stuff in-house, go ahead and turn around and apply to megacorp, and possibly skip out on applying to TimCo, depending on how big of a red flag you think Tim's behavior was on the poaching.
If they indicate that they don't do stuff in-house and go exclusively through sub-contractors, go ahead and only apply to TimCo. Tim didn't do anything wrong, though he probably should've simply said, "Megacorp doesn't hire people directly for this sort of position - they subcontract it out."