What are the two AD group types, and what is each one for?

Security groups are used to grant permissions; distribution groups are only email distribution lists and cannot be used in access control.

• Security group: has a security identifier (SID) that goes into the member's logon token, so it can be put on access lists (file shares, folders, GPO filtering, delegated rights). It can also receive email.
• Distribution group: used by the email system (Exchange) to send a message to many people at once. It never appears in a logon token, so granting it a folder permission has no effect.

For access management you almost always want security groups.

Go deeper:

• Microsoft Learn: Security groups vs. distribution groups — distribution groups are not security-enabled, so they can't appear in access lists.