Differences between these Qubes?

You should use sys-firewall, because it protects from DMA attacks See also: Firewalls & secure network configuration.

2 Likes