If understood everything correctly, enabling both AAIP and quiescence
at the same time will address the issues in the following manner:
1) Ability to selectively exclude individual VM's from having VMware Tools quiescence utilized
With both AAIP and quiescence enabled the job will attempt to process the guest with AAIP and will failover to quiescence for those VMs where AAIP has failed.
2) Option to revert to non-quiesced backup after n fails
If you choose "Try, but ignore failures" in AAIP settings, then it will still perform backup if quiescence fails.
* Customer doesn't want firewall ports to be opened
Have you considered using VIX for that?