An IP address is considered as "protected" by ASL when traffic for that IP address passes ASL and belongs to your "protected" organization (so, it is not an "external" IP).
For example, if you use ASL as a "department" firewall, you only pay for the IPs in that specific department, not the whole company.