NSX has two kinds of firewalls - Distributed Firewall (DFW) and Edge Firewall. Both serve different purposes. The Edge firewall is the firewall you use in the "North/South" case to protect your network from external connections. I am using it as an Internet firewall. The Distributed Firewall protects the actual VM which is more for "East/West" protection. I will be using it to only allow Internet VPN users access to a group of VMs. It can be used to only allow or prevent ports directly to the VM. You are correct that the DFW is in the kernel of the ESX node whereas the Edge Firewall runs as a VM.
I hope this helps a little. I would be happy to answer to the best of my knowledge any other questions you may have.
Richard
