I'm going to explain the rationale of my answer in an agony aunt format, partially because it largely depends on the purpose of the vulnerability scanning. My answer is at the bottom.
IPS / anti-DDOS - for the purposes of this question, I'm assuming this is a 3rd party service that proxies requests from the public to your underlying systems (e.g. CloudFlare or Incapsula). However, many of these concepts would apply to an IPS you had running on your own perimeter network. IPS = Intrusion Prevention System.
Underlying systems - these are the systems that you actually own and control, assumed to be on your perimeter network.
I want to evaluate how effective my IPS or anti-DDOS service is at preventing vulnerability scans
What an odd request!? Well in this situation you should consider running your vulnerability scan through your IPS/anti-DDOS service. Your findings from such an exercise will tell you roughly what an attacker would see if they ran the same scan.
I want to evaluate how effective my IPS or anti-DDOS service is at preventing the exploitation of vulnerabilities on my underlying systems
Due to their very nature, a vulnerability scan is unlikely to help you with this. Vulnerability scans need to operate at a reasonable speed for efficiency (they typically have to check A LOT of vulnerabilities to be thorough), and IPS/anti-DDOS services are designed to stop network patterns that look like this (i.e. automated). They might not find many, but it doesn't mean that there are no vulnerabilities that could be exploited by a human.
You might want to consider having a penetration tester try to exploit known vulnerabilities. It makes sense to have a benchmark of vulnerabilities that you know exist on the underlying systems.
I want to detect vulnerabilities that might be present on my underlying systems
Firstly, this is a very good idea, because these are the systems that you actually own and control, and have some responsibility over with regards to security.
We've established that vulnerability scanning through a functioning anti-DDOS and/or IPS is a bad idea if this is your end goal. There's a good chance that the scanner will be blocked where a human attacker might succeed.
However, vulnerability scanning is still a very efficient way of detecting issues, so we don't want to throw it out. If you whitelist the scanner's IP address in the IPS / anti-DDOS service, it should be able to scan uninterrupted. Alternatively, you could allow direct access to this IP through the firewall (although the rules should mimic what users can see through the anti-DDOS system). You may want to consider only activating these rules at scheduled scan times.
Scanning from an internal perspective may be valid also. Ideally, you want assurance at multiple layers, and ideally one of these would be scanning through any network devices that do no interfere with the scanning, such as your perimeter firewall. This may not be possible without using the external IP address, at which point it may be no different from your external scan.
Bear in mind that it is possible some detected issues would have been mitigated by the anti-DDOS / IPS service. In this case, see the I want to evaluate how effective my IPS or anti-DDOS service is at preventing the exploitation of vulnerabilities on my underlying systems section.
A penetration tester might give you more scope for testing through an IPS / anti-DDOS, but it still might not be the most efficient method for them to identify vulnerabilities.
I want to make sure that my firewall really is blocking everything except for the anti-DDOS service
Run external port scans against your underlying systems, where the scanner does not have any special firewall exceptions. Vulnerability scans usually start off with port scans, so they should suffice.
If you do identify additional services that are Internet-facing, and they can't simply be filtered off (i.e. they are required) then there's no good reason why you shouldn't be subjecting them to vulnerability scans as well.
Vulnerability scanning isn't necessarily a good test of real world attacks, but it's still very useful to administrators. IPSs and anti-DDOS services may interfere with results, preventing detection where vulnerabilities can still be exploited by a human.
In terms of priorities, depending on the resources you have, here's what I'd focus on (in order):
Vulnerability scans of your own underlying network. Allow your vulnerability scanner the same access as the anti-DDOS service, or whitelist on the anti-DDOS service.
Determine how effective your IPS / anti-DDOS service is at mitigating any of the vulnerabilities discovered during priority 1. Best use a penetration tester. Alternatively, don't bother and just fix everything regardless.
Penetration testing is really outside the scope of this question, but since we've identified that vulnerability scanning isn't really a good way to simulate real attacks, I think it should be mentioned as an additional way to gain assurance. It can provide some of the realism that you might be trying to achieve by running scans through anti-DDOS.