Ingress rules: service vs workload backend

When creating an ingress rule, what’s the functional difference between choosing a service vs a workload for the backend? In what cases would I want to choose one over the other? By default a new ingress rule selects workload, but I’ve been deleting the workload rule and adding a service instead, since it generally makes more sense to me to interact with the kubernetes svc that’s fronting a given deployment. I suppose I’m asking this in part because it’s unclear to me how the term ‘workload’ is being used in Rancher.