By default we use WPA/WPA2 mixed, meaning if the device is able to connect over WPA2 that takes priority. If the device only supports WPA, then the node will authenticate with that instead.
If you check WPA2 only, then devices that can only connect with WPA will not be able to connect to the mesh. Both WPA and WPA2 use the single PSK (WPA-PSK/TKIP) entered in the dashboard. If you were to check the "WPA2 Only" box, it will change the encryption from WPA TKIP to WPA2 AES only.