What is the difference between adding a user or group to an individual form's access rights tab and adding the same user or group to System Security (accessed through the Administration 'gear' icon at the top of all forms pages)?

We have set an individual form's access rights to Starting Form = Public.  So anyone can fill it in and submit it.  But our Process Model requires that a licensed user then log in and approve the form.  We have this person's user account added to forms through the Administration 'gear' system security but not to the access rights of the individual form.

And this works - but I would like to know the difference between the two.  Should i be adding this user to the individual form's access rights only or the system security only, or both?