we have remote access vpn user and we wish to control their IP access on the network. Which acl's need to be applied and where to allow and block access to the internal network?

The setup is:

home vpn user --> Internet --> ASA5500 --> internal demarc vlan --> CAT6500 --> Internal network

do we need nonat acl's to control what the vpn users can access?