They are separated licesnse...
PEF license its a firewall license... its really handy for many things, it enables you to use the embebed firewall on the controller
One of the uses for example
Let say you got 2 SSIDs
One corporate SSID
One guest SSID
Normally you wouldnt be able to separate the traffic between the guest users from the corporate network... you would need to use a separated vlan and then on the switch core or something like that start building access list, to separate the trafffic...
With this licesnse you can do it from the controller which is a way better.
Aruba is the only wifi solution that got a embebed firewall on the controller! really good thing for security....
Anyways thats just one example, it can be used for many things...
When i sell a Wifi solution to a client i recommend them the PEF license and the rfp licence but if they cannot affod them both i recommend them to have at least the PEF license.
Cheers
Carlos