Explain in depth the differences between vulnerability scanning and penetration testing?

Explain in depth the differences between vulnerability scanning and penetration testing?

A small business wishes to hire you as a consultant.  They have purchased 5 IP addresses from their ISP but need 25 more over the next year. You decide to set up Network Address Translation (NAT) for them. How would you explain this to the owner, who is not technically adept?