I know that site-to-site is using IPSec (layer 3),
This does appear to be the case.
but client is using TLS (application layer).
Not sure where you are reading that? the documentation seems to indicate that AWS client VPN is openvpn based
OpenVPN uses TLS for negotiation, but does not use it for the actual data.
It seems like both are actually site to site vpns after reading articles/ docs online.
Openvpn is capable of performing both client and site to site VPN tasks, but AWS seems to be using it as a client VPN, I don't see anything in the documentation that would allow you to say allocate a whole netblock to an individual VPN client.
Of course you could run a NAT on the VPN client, to allow all the devices behind it to use the VPN, but that would not be using the service as-intended.
I guess the protocol (IPSec vs TLS) is their only difference
Site to site and client VPNs have different priorities, which drives different typical protocol choices.
The problem with ipsec is it was designed in an era before pervasive NAT. The result is it runs directly on top of IP and does not have anything analagous to TCP/UDP port numbers that NATs can use to disambiguate multiple client sessions.
So using an IPsec VPN from behind a NAT is a dicey proposition. It may not work at all, or more insidiously it may work, but only for one client at a time.
For a site to site VPN this is not usually a big deal, your edge device will most likely have a public IPv4 from a consistent ISP.
For a client on the go, it's a big issue. So using a VPN soloution that runs on top of UDP or even TCP (openvpn can do either, I'm not sure which configuration amazon use) is likely a good idea. Even if it is less efficient.