Laymen explanation of Allow IP traffic vs. Allow only application traffic

I've read the conversation entitled "Unmatched IP traffic setting?" (12 Aug 2009), but the majority of my users would need more simplification.

My workstation\laptop clients (~1000) were configured with the 'Allow IP Traffic'.

I would like to change the default policy to be "Allow only application traffic --- with prompt"

What I need is a laymen's explanation for what this policy means and why this change will increase the overall security of their computer.

thank you.

willG