Hi Marco,
The solution to the issue would lie in using a Router with the 'ip helper-address' command configured on it, so that the DHCP broadcasts are forwarded to the DHCP server.The DHCP requests which are broadcasts are not sent through the tunnel.
I have checked the documentation but haven't found any configurationon the concentrator to implement the ip helper-address functionality, so the Router would be the only choice.
The option for DHCP (Configuration, System, Address Management, and Assignment) is available for VPN Clients connecting to the Public Interface and requiring access to the private network. The Internal users would not be able to use this option.
Here's the doc on configuring the DHCP relay feature on the VPN 3000 concentrator.
http://www.cisco.com/warp/public/471/vpn3000_dhcp_relay.html