Yes it can, Please check below:
VMware provides a vSAN Witness Appliance for those customers who do not wish to use a physical host for this role. The vSAN Witness Appliance must run on an ESXi 5.5 or higher host.
Storage and Availability Technical Documents
Yes it can be. Ran into this exact scenario yesterday. It needs a host capable of running a VMX-10 hardware version.