(not set)
This is the value that is placed in the keyword column when the user did not use a search engine to find your site.
(not provided)
This is the value that is placed in the keyword column when the users search query was encrypted.
Encrypted search is the default for users that are logged into their Google account.
How will this change impact Google Analytics users?
When a signed in user visits your site from an organic Google search, all web analytics services, including Google Analytics, will continue to recognize the visit as Google “organic” search, but will no longer report the query terms that the user searched on to reach your site.
(emphasis mine)