The three choices are
Allow all incoming connections, as the name suggests all incoming connections are allowed.
Allow only essential services, all connections apart from the necessary OS X ones are blocked.
Set access for specific services and applications, this means you decide which applications can or can not allow incoming connections. So if you were to select this box, you would then click on the + and select Safari and set as allow, then do the same for Mail, Firefox, meaning you can still download from the Internet. These are the applications that will require internet access, so you won't need to add in iLife, iWork, Office etc unless you are doing something that requires internet access i.e. publishing a webisite, uploading to YouTube / .Mac.