Re: VDOMs and Wireless - can someone point me to the documentation?
This looks like v5.6 added feature (can't find "Virtual AP" in 5.4 online help). You need to enable this "virtual AP" at below:
config wireless-controller global
set wtp-share enable
What this does seems to be making tunnel SSIDs/VAPs floatable to different vdom from the one an FortiAP is controlled at, like root vdom. So technically the APs are still controlled by only one VDOM, root. But VAPs can be defined each customer vdom. And again each SSID/VAP belongs to one customer vdom and not be shared. APs are logically shared between them instead.