But when should I use each?
I suggest you to use /etc/config/firewall editing that file or via WebGUI.
advanced iptables stuff not defined in uci use /etc/firewall.user (to
access directly iptables stuff).
use /etc/uci-defaults if you reach a bug and you cannot manage it with
uci config file or webgui