Wireless Access

Is it possible to have an external device, such as a camera, connected to an access point's second Ethernet port and IPSEC tunnel (the access point will only have an Internet connection) that traffic back to the controller tagged as a different VLAN to the wireless traffic?

Yes.

If you have the access point configured as a remote AP, you would set the forwarding mode of the ethernet port to tunnel and set the VLAN you want it to be on in the Wired AP profile.