A hidden service is truly hidden, this add another layer to discriminate clients.
In traditional HS, a hidden server publish in the tor network how to begin a communication with it (not its true location, tor uses a complex middle nodes link setup for bidirectional route anonymization, the server and client knows nothing about end point's location, same for the rest of the tor network). A client ask to the network how to reach a HS with this info.
In the authorize client option one mechanism provides two more features, a hidden server publish encrypted instructions of how to begin the communication, a client with the right key can decipher this info. And with the same key, the HS expects the first handshake to be made. If you are an authorized client, you only can locate the HS path and then try to establish connection if you have this key. Indeed you can prevent a DDOS because if the client does not have the key, it can not find the path to the server.
There is two flavor of this, the basic mode, where many keys for the same onion address are published, and the stealth mode where for the same HS the server publish differents onion addresses with each different key.
The security difference of this modes are that basic mode can escalate to many keys but the tor network knows how many keys are (not how many users connect with this keys, or when), can scale easily for big HS servers. Stealth mode is limited to more or less 16 keys, but the tor network knows nothing if this keys are for the same HS. Good for small setups, not so wheel for massive HS services. There are ways to overcome the limitations of the stealth mode.
I use the stealth mode quite a lot for my SSH servers. I have a different onion and key set for every client.