Yes, one can create VPN between two S1500s (site-to-site)
And,
Since, Mobility Access Switch supports only Site-to-Site VPN configuration,
Where as, IAP support VPN client connecting to a VPN server (concentrator) such as controller or third-party-VPN concentrators.
Hence, I beleive you can't have VPN between IAP & S1500.