You don't need to have two VCO servers for this case, if you use shared session for one of the vCenter Server.
If I have understood correctly, the objects registered in the two SSO servers are separate (you can not register in SSO 1 and use its token for SSO2), so you can register your VCO server to authenticate in SSO1 for eaxmple. The VC01 can be added using session per user and VC02 can be added using shared session configuration.
In this case the problem is that you will be able to manipulate the VC02's object using the credentials provided for the shared session configuration and you might want to restrict the permissions to the VC02 objects.
If you want to have more restricted access to these object you will need two VCO servers - this way you will register the VCO to authenticate against SSO and you will be able to register VC02 in VCO02 using session per user.