What is the difference between EXPOSE and -p in terms of networking?

EXPOSE only documents which port the application listens on inside the image/container — it creates no actual network rule and has no effect on reachability. -p (or --publish) is what actually creates the iptables NAT rule making a container port reachable from outside, whether or not EXPOSE was declared.