The actual connection of surge arresters can be confusing. Thus, you must read Art. 280, Part II, carefully to get this right.
In the NEC and other standards, the word "grounding" is often misused to mean "bonding." That isn't the case in Art. 280. It really does mean grounding (per Art. 100, "grounding" is an earth connection).
Your decision on where to locate surge arresters has to account for your intended wiring scheme, keeping in mind that you want the grounding conductor(s) to be as short as is practical [280.12]. You can locate surge arresters indoors or outdoors, but either way you have to make them inaccessible to unauthorized personnel [280.11] (unless you get the surge arresters listed for installation in accessible locations and comply with the installation instructions for those).
The grounding connection is crucial. Remember: The grounding conductor of a surge protector is not the same thing as an equipment "grounding" (bonding) conductor (EGC). With an EGC, you are eliminating differences of potential. Connecting an EGC to ground doesn't do anything but waste wire. However, with the surge protector, you are actually intending to establish a path to earth. Toward that end, 280.4 provides seven variations of such a path.