Hello Douglas -
Yes you can authenticate two different ways, however, only one method at a time.
When you have created manual accounts in TMS for provisioned users, you can authtenticate using those users accounts/passwords that you've created. The accounts are configured within TMS, and are stored within the VCS's local database.
Importing users from AD into TMS only improrts the users information (name, usersname, comapany info), it doesn't import passwords. You'd have to configure the VCS to use Active Directory Services to join your domain. When a users tries to log in, they will then authenticate to AD via the VCS.
If you try to do an import from AD within your provisioning directory, you'll need to delete the manual accounts, as the import will give an error when it tries to import/create a user that already has a manual account created. I can't say for certain, but you might be able to leave the manual accounts, and run with it that way, just have to remember those specific accounts won't be moved/deleted if your AD structure changes.
I'd recommend you take a look at the Authenticating Device Deployment Guide for your version of VCS, it can help a lot.
http://www.cisco.com/en/US/products/ps11337/products_installation_and_configuration_guides_list.html
