Each handles a different phase.
https://openresty-reference.readthedocs.io/en/latest/Directives/#access_by_lua
access_by_lua_file acts as an access phase handler and content_by_lua_file acts as a content phase handler.
Refer to http://nginx.org/en/docs/dev/development_guide.html#http_phases
NGX_HTTP_ACCESS_PHASE — Phase where it is verified that the client is authorized to make the request. Standard nginx modules such as ngx_http_access_module and ngx_http_auth_basic_module register their handlers at this phase. By default the client must pass the authorization check of all handlers registered at this phase for the request to continue to the next phase. The satisfy directive, can be used to permit processing to continue if any of the phase handlers authorizes the client.
NGX_HTTP_CONTENT_PHASE — Phase where the response is normally generated. Multiple nginx standard modules register their handlers at this phase, including ngx_http_index_module or ngx_http_static_module. They are called sequentially until one of them produces the output. It's also possible to set content handlers on a per-location basis. If the ngx_http_core_module's location configuration has handler set, it is called as the content handler and the handlers installed at this phase are ignored.