Hi, I think the description in the UI is relatively good (not sure if you saw it)
If private, this function may be called from incoming webhooks, rules, and other functions defined in the App Services console. Private functions may not be called from client applications.
The idea is just that if you define a function as private it is only callable by other parts of app services (almost like declaring a function private). So that would mean only things like triggers, rules, webhooks, etc can call the function.
Making the function public means that external users can hit the client-api and run the function, but authentication and authorization are still performed as configured by the application.
Best,
Tyler