I am getting really confused as when to use AAM and when to use header. I wish there was table to list scenarios and based on that you would pick AAM or host headers.
Same thing I am trying to achieve for Authentication Provider between different zones (default, custom, intranet, extranet, internet).
As a rule of thumb you can say that every URL that ends up in the browser address bar anywhere should be a public URL, therefore a separate zone has to be created. As a good practice, each zone should have its own separate IIS website so you can configure different IIS-related settings like host headers, SSL certificates etc. The public URL is what's being used by SharePoint to render your content correctly and to assure a consistent URL experience.
The public URL is not necessarily the same URL that is used in the request that the server receives, but SharePoint will always answer with the public URL in its response. This is useful in scenarios like publishing a web application to the internet. Users on the internet might make a request to https://www.internetsite.com, but the reverse proxy server may forward this request to http://servername:1234. In that case you have an internal URL http://servername:1234 that maps to a public URL https://www.internetsite.com. This allows the SSL certificate to exist only on the reverse proxy server which simplifies management. This is just one use case for AAM's, there are other like the redirections you mentioned.
The IIS host header on the other hand is used to make sure requests arrive at the correct IIS site in the first place, before getting picked up by SharePoint. In my example we could have an IIS web site without a host header as we're just using a port number. If we would redirect our reverse proxy server to http://internetsite.local however, we could set a host header of internetsite.local on the IIS website. This way IIS knows which website on port 80 to send the request to.
So the host header in IIS is not neccesarily the same as the public URL in SharePoint, but it will always exist as an internal URL in the AAM mappings.
The different zones in SharePoint relate to having different public URL's and different IIS websites. This allows to have different settings, like different authentication mechanisms as you describe. In SharePoint 2010 you can have multiple authentication providers in one single zone however. The names used for the zones are just labels, you can use any zone for any purpose you want. Only the default zone is a bit more than just a label when it comes to security.
A very good and thorough series is the "What every SharePoint administrator needs to know about Alternate Access Mapping".
Generally speaking you'll need to add host header bindings for each different URL you're trying to configure regardless of what zone you're putting it in. The public URL will pretty much redirect whatever bindings you have to that URL zone for example if I have:
Default: 'http://portal' Default: 'http://portal.internal.domain' Public URL for Default: 'http://portal.internal.domain'
My host headers in IIS for the web application site have both: 'http://portal' and 'http://portal.internal.domain' listed.
Any user that hits the site using 'http://portal' will find on their next click within the site that they'll be now using 'http://portal.internal.domain/subsite/page.aspx'
If you need to expose the site externally then you'll just want to configure an Extranet URL of http://portal.external.fqdn.com and add that to the host header bindings for the IIS site as well. You'll also notice that there will be a public URL for Extranet which will work the same way that the default one does. So its really depending on where your users are consuming the site from. You might also find that a branch office is needing the 'Internet' zone configured so that will need an appropraite URL if its unique from the default or extranet one.
