Hello. I'll have a go but first I must shyly admit that I have no SP experience, where most of my work has been in the Enterprise. While I might not be able to understand / answer everything you've presented here, I think I can add some conceptual knowledge about ACI that applies to all topologies.
First, because you work in an SP environment, it might help to think about VxLAN as "MPLS for the DC Switched Network". I say that because fundamentally they are both designed to solve a similar set of problems (although one in the WAN and another in the DC). Because ACI is multi-tenant, we need a way to provide L2/L3 reachability across what is a purely routed DC fabric and keep all the tenants separate from each other. Instead of an MPLS tag, we can use VNIDs and other tags in ACI, which are available to us with VxLAN.
With that pre-understanding behind us, the answer to your first question "VxLAN will be configured only between spines or VxLAN is also at leaf level?" is that we use VxLAN exclusively between leafs and spines only (spines don't connect directly to other spines). This is to say that any endpoints you attach to ACI don't need to understand VxLAN and can work as they have always worked, using standard Ethernet/IP and VLANs. While I am taking great liberties with how MPLS works, conceptually it is useful to view your ACI leafs as MPLS-CE routers. When an endpoint (ACI-speak for anything you connect to a leaf port where we learn MAC and/or IP regardless of form factor, like VM or baremetal) wants to speak to another endpoint that lives on another leaf, the leaf encaps that traffic into a VxLAN packet and using the right VNID (ACI's tagging method) we can send it along across the spines, until it gets to the far side leaf, where it is de-encapsulated from VxLAN, and back into a normal 802.1q ethernet frame and forwarded down to the correct receiving endpoint. I am oversimplifying this process but conceptually it works like that.
So your second question "how an interface like S1-MME or S1-U is routed in Data Center...considering IPSEC", to ACI it really doesn't matter. As long as ACI knows how to reach the IPSEC tunnel endpoints, it will happily send traffic as it normally does. Obviously, ACI won't know what's inside the IPSEC tunnel, but it will view tunnel endpoints as regular ACI endpoints, without needing anything special.
I want to have a side discussion on your design (second image). Normally, all endpoints, including routers that lead to the outside world or other DCs, are attached to the leafs. We don't connect endpoints to spines, only leafs connect to spines. This holds true in ACI until you start talking about advanced solutions we call Multi-Pod and Multi-Site. I am not sure if you are considering those solutions for ACI, so I don't want to write too much here. Just note that because you have multiple DCs, these solutions go along way to making that DCI and Operation a lot easier than it has been in the past. I suggest you check them out to know what your options are.
So to summarize, ACI will view your Apps/Interfaces/VMs/Whatever as normal Ethernet/IP based endpoints. It will happily forward traffic for them (assuming you tell ACI to do this) just as it has always been done in the traditional networking past. But now we have the benefit of VxLAN as a way to scale, and keep traffic separate as it moves across a multi-VRF, multi-tenant ACI core, just like MPLS tags do in the WAN.
I hope that made sense ;) I also ask forgiveness from any SP wizards reading this for my gross oversimplification of things like MPLS and VxLAN.
