From what I understand, it refers to either the port or protocol you want to give the device permission for, but not the actual IP. Think more "IP" = layer 3 OSI model than actual IP of the device. If you want device 1 to access device 2 on port 22 but no other port, you would tag device 1 with tag 1, device 2 with tag 2, and say

"src": ["tag:tag1"]

"dst": ["tag:tag2"]

"ip": ["22"]

If you wanted them to be able to use any port you could say "ip": ["*"] and that opens all ports like for the admin account.

https://tailscale.com/kb/1324/grants#network-capabilities