A front controller plugin executes for every request, at specific stages in the MVC cycle. You can use it to perform work like checking whether a user is authenticated or logging requests to a database for analytics.
A controller action helper can also perform at different stages of the MVC cycle, though this isn't mandatory. The key difference between plugins and action helpers is that your controllers can interact with action helpers to change their behaviour, or use some on-demand functionality.
A plugin is often better for things that ALWAYS need to happen, while an action helper is useful for occasional tasks, like sending a JSON response.
An example for controller/helper hooks:
You have an action helper that checks at preDispatch whether a user is logged in and, if not, asks the user to log in. In your login controller you want an exception to this rule, or you'll loop infinitely. In the login controller's init method you can do the following, as the init() is called BEFORE preDispatch:
public function init() {
$this->_helper->myHelper->setAuthenticationRequired(false);
}
This sets a boolean in the helper to skip the authentication check.