When you need to create a separate content database with a separate authentication mechanism, you should add a web app. If you just need to show the same content to a different user group, extend the web app.
If you have a lot of web apps, pay special attention to the performance tuning of those application pools. Any app pool running takes up server memory but when an app pool stops and starts again, you get the "lag" of the site re-compiling.