Security is the same. There are differences under the hood with regard to roaming and caching, header labels, and a few other things. WPA/AES is not tested during the WiFi Alliance certification process so there's potential for compatibility issues.
If your clients can't support WPA2 then they probably can't support WPA/AES either, so my thinking is go with the certified combinations and do WPA2/AES and WPA/TKIP. (There's no reason in the world to enable WPA2/TKIP since all WPA2 clients must support AES.)
