I would like to have the ability to connect to the Shield VPN protected connection via wifi.
Is it possible to buy a USB Wifi adapter, connect it to the USB port of the Shield and have Shield use it to set up an access point for a new wifi network? (Brand new SSID)
Depends on the card, available firmware, and driver support.
Some cards can’t do AP at all. Others do it just fine out of the box. Some do it, but you have to find a copy of the AP version of the firmware (some Marvell cards fall into this category). Some only do it on certain bands (like the Intel 7260). Some can, but the FOSS drivers don’t support it.
Even if it works, it will probably be pretty subpar compared to getting a card intended for the purpose.