The filter can also be used to have multiple services on the same port, so long as it's possible to narrow it down.
For example, if you have two external services that require a port forward on 443 to two different internal servers, you can use the VIP filter to narrow it down to the source public IP of the service. That way you can have two seemingly conflicting VIPs without the need to do port translation(or use a different public IP on your side).
I don't recommend using port-forwarding VIP unless absolutely necessary. I have none in production, as my public servers have a 1-to-1 mapping. Firewall policy is where only port 443 (HTTPS) is allowed. No reason to complicate things unless you need multiple servers to listen on the same IP (something I know happens often enough for some folks).