You can use 1 acl - I personally choose to use 2, helps with troubleshooting cases....like this. I normally use something like:-
access-list no-nat extended permit ip x.x.x.x y.y.y.y w.w.w.w z.z.z.z
x.x.x.x = src ip sbunet
y.y.y.y = src subnet mask
w.w.w.w = dst ip subnet
z.z.z.z = dst subnet mask
then:-
access-list vpn-remote-branch-1 extended permit ip x.x.x.x y.y.y.y w.w.w.w z.z.z.z
The my nat looks like:-
nat (inside) 0 access-list no-nat
and my crypto looks like:-
crypto map remote-branch 10 match address vpn-remote-branch-1
HTH>
