A restrictive filter type denies all incoming IPs except those specifically allowed by the allow element. A restrictive filter without an allow element denies logons from all IPs regardless of which IPs are explicitly denied by the deny element.
You can use restrictive filters to define the allowed IPs for a list of users, while retaining the ability to use the deny element to disable some of the allowed IPs.