you are correct you would need two.
the first being vintela to access the frontside AD authentication then after aliasing the sap and ad accounts you would need snc or sts for the backend BW connection.
Be sure to see the following post:
http://scn.sap.com/docs/DOC-33875
-Josh
