Tunnel mode wraps the entire original packet inside a new IP header. The original source and destination addresses get encrypted. You use this for site-to-site VPNs where you're protecting traffic between networks.
Transport mode only encrypts the payload, leaving the original IP header intact. You use this for host-to-host encryption where both endpoints support IPsec directly.
Most VPN deployments use tunnel mode because it hides the internal addressing.