Yes, security groups operate at the instance itself while FWaaS supports one policy from the edge of the network, and filters traffic before it enters the network.