Qlik Sense Enterprise on Windows is a web-based application, so it needs to handle to key capabilities:
Accepting requests to use the product
Handling user identities
A Proxy is a web server. It accepts the requests to use the product (1).
A virtual proxy is a method of authentication. It determines how users should identify themselves so users can be properly allocated access to resources.
Any given Qlik site can have one or many Proxies (webservers). Each proxy will have at least 1 virtual proxy which uses Windows / NTLM as a method of authentication. Any given Qlik site can also have one to many virtual proxies to handle use identities from different sources (e.g. internal / external, child / parent corporate entities, etc).