Yes - there are two ways to get through a firewall. So from the VPN perspective, you will want to be sure your client app and VPN pass bonjour packets so the remote iOS device can see the Mac that is advertising it's VNC screen sharing capabilities. AirPort hardware does a good job of proxying the VNC capabilities of sleeping macs and will even wake them up in response to incoming requests for screen sharing.
No - there is no iOS VNC client so your "out of the box" experience will involve going to the app store or otherwise installing an app like Screens or whatever other VNC app you prefer.
I can speak for screens working in a mixed VPN / NAT port forwarding combined network where Lion server has configured the VPN and controls the AirPort. I do use the screens connect software and location service when I am not using VPN since that allows me to locate my macs similar to Back to My Mac does using iCloud. The screens solution really works well for me with or without VPN or needing iCloud integration. You don't need the screens connect in most cases when VPN is set up, but it's nice to have and doesn't interfere with VPN either.