The type of image that may be used to boot or load a device follows the same logic as images used to provision new devices. Virtual Server Instance (VSI) may utilize both Standard and Flex Images for either the boot or load process. Loading a Bare Metal Server from an image is limited to using a Flex Image.
With security groups, you can enact a set of IP filter rules that define how to handle incoming and outgoing traffic to both the public and private interfaces of a virtual server instance. A security group creates a sort of virtual firewall.
For more information about the security groups feature, see Getting started with security groups in Bluemix Docs.