If a shared IP is used it would be expected to the use that IP, depending on which interfaces is active/primary for VPNs would determine which of the potentially 2 VIPs to use.

It will scan the channel its on when clients are connected, that is a limitation of no security radio it needs to serve clients. When no clients are connected it is free to scan, there are some additional thresholds for busy times and dfs that apply ...

The MR28 has most of the features but does not natively have a scanning radio so if you need that with other functions it may be a bit limited. You can swap modes but if the AP is scanning it won't serve clients so testing air marshal events may be p...