First of all, I urge you to choose an altogether different way to determine which alternative you want your template to exercise. It is usually better in Puppet to choose configuration details based on static information (recorded in an Hiera data store, for example) or semi-static information (e.g. based on resources exported during the process of building other nodes' catalogs). There is a range, but ephemeral data such as whether the master can establish a TCP connection to a particular host at a particular time are a particularly poor basis for such choices.
If you insist on proceeding in that direction, however, then you need to recognize that when
TCPSocket.new() fails, it throws an exception rather than returning a value that evaluates to false. If you want processing to continue within your template, then you need it to catch that exception. That would look something like this:
TCPSocket.new("host1", 636) and TCPSocket.new("host2", 636)
%>
host xxxx
port 636
tls_checkpeer yes
host yyyy
port 389
tls_checkpeer no
<% end %>
Overall, always remember that ERB is just a somewhat unusual way to write ordinary Ruby code. It's expressed inside out, but once you learn to see through that to the all-Ruby code it represents, you can rely on your Ruby knowledge (or someone else's) to understand how to create, interpret, and use ERB templates.
John