is_email() will take the provided string( a email address) and run checks on it to ensure that it is indeed an email address and that the string has no illegal characters in it. It would simply not change anything in the string you provided but return either true if the string passes all the function checks or false if it doesn’t.
The sanitize_email() will take the provided string and strip out any characters that are not allowed in an email address and return only the characters that are allowed.
So if you had a string that needs to be an email like: user"[email protected]
is_email() would return false as the string contains characters that are not allowed in an email address.
sanitize_email() would return [email protected]
If you take user"[email protected] and first run it through the sanitize_email() function and then through the is_email() function it would then return true in this case as all the invalid characters are removed from the string and this allows the string to pass the is_email() checks.
I would suggest using both, is_email() to check first if the user submitted a proper email address and before commiting anything into the database check that is is indeed safe by running the sanitize_email() function at the latest possible point in your script.