Protected - When a violation occurs, it´ll simple ignore any exceeding MAC Addresses,for example (if you allow only one MAC Address, it´ll permit the first MAC Address to transmit, and drop everything else for any new MAC Address trying to transmit to this port).
Restrict - Does exactly the same thing as Protected mode, but will also send a SNMP Trap regarding the violation.
Hope that helps.