The ACL is always entered as "any" in ACS, and that's how it looks when it's downloaded to the PIX. However, this downloadable ACL is applied per user, and each user is mapped to one IP address, so in effect even though teh ACL says "any", it's always only applied to that one IP address where the user authenticated from.
A "sho uauth" command will explain what users/IP address are authorized to do what.
I guess if you knew one user was always going to authenticate from the same internal IP address, you could apply a PIX downloadable ACL with that IP address as the source, but it's really not necessary. Don't think the ACL is applied to the inside interface, it's not, it's applied to that users session and only that users session.
