In what way are SSL VPN and IPSec VPN different?

IKE (Internet Key Exchange) is used by IPSec, not SSL VPN; and it is SSL VPN - not IPSec - that is commonly described as clientless.

IPSec adds protocol headers (ESP or AH) to packets for encapsulation and authentication; SSL VPN does not add a separate VPN header in the same manner.

Two-factor authentication is not an inherent limitation of IPSec; both SSL VPN and IPSec VPN solutions can be configured to support multi-factor authentication depending on the implementation.

IPSec VPN clients create a virtual network adapter (e.g., a TAP or TUN interface) on the endpoint to encapsulate and route traffic through the encrypted tunnel. SSL VPN, in contrast, typically operates over the client's existing physical adapter using HTTPS/TLS, which is why SSL VPN is often described as 'clientless' or requiring only a browser.