I found this post while trying to answer the same question. I'm far from a vmware expert (very, very far). But in my limited testing, this seems to be a significant difference between the two options: (using ESXi, 7.0.3, 20842708 and vsphere)
Scenario 1:
- from the VM "Add New Device" menu, select Network Adapter.
- in the "New Network" dropdown, I have the option to select a port-group.
- In this case, I select the port-group that's bound to a vswitch. Specifically, the vswitch that's connected to my SR-IOV-enabled adapter.
- I then have a VM that shows an "SR-IOV network adapter" in its hardware settings.
- If I look at the host's vswitch layout (host > configure > virtual switches), I can see that my VM has been associated with the aforementioned port-group & vswitch.
Scenario 2:
- from the VM "Add New Device" menu, I select PCI-Device
- I'm then prompted to chose from available PCI-devices. Listed among them are my adapter's SR-IOV virtual functions (VFs)
- I chose one of them and click "Select".
- The VM then lists a "New PCI-Device" corresponding to the PCI ID of my selected SR-IOV VF.
- If I look at the host's vswitch layout (host > configure > virtual switches), my VM is not associated with the port-group I mentioned above.
- In this case, it appears the SR-IOV VF has been added to the VM like an old fashion PCI-Passthru device.
So in that second scenario, I assume you're losing whatever connectivity or enforcement options you get with port-groups and vswitches.
Hope that helps.