Off completely. This allows no federation with any external domains.
On except for blocked domains. This allows federation with all domains except those that you add to the blocked domains list. When you choose this setting and click the + (Add) button, you are then asked to supply the name of a domain that uses Lync, that will be blocked from communicating with your users.
On only for allowed domains. This allows federation only with the domains you add to the allowed list, and blocks federation with all other domains. When you choose this setting and click the + (Add) button, you are then asked to supply the name of a domain using Lync that will be allowed to communicate with your users.