By using static & access-list & access group command.
Take the following example: 209.165.201.3 is the public address used to reach the server, in your case the FTP server. 192.168.3.3 is the IP address physically assigned to your FTP server, it's an private IP address.
Command #1 : static (dmz3,outside) 209.165.201.3 192.168.3.3 netmask 255.255.255.255
a)Replace "dmz3" with the name of the DMZ segment where your FTP is place.
b)Replace the public IP address (in this example:209.165.201.3) with your public IP address to reach the FTP server from the Internet.
c)Replace the private IP address (in this example:192.168.3.3) with your private IP address physically assigned to your FTP server.
d) The netmask should be 255.255.255.255
Command #2: access-list acl_out permit tcp any host 209.165.201.3 eq ftp
a) Replace the word "any" by the host IP address or network IP address you want to give right to access.
In case of a single host you must write "host x.y.z.a" (x to a must be replace by the real IP address.
In case of a network: write the network IP address following by the netmask (For instance: 202.142.142.0 netmask 255.255.255.0 identify all host between 202.142.142.0 to 202.142.142.255)
b) The word "acl_out" is an alias used to identify the rule. You may used any alias you want. But you must have the same name for all the access-list or access-group command linked together.
c) You may repeat the access-list command as often as necessary to configure all the access needed. With the same name as indicated before.
Command #3: access-group acl_out in interface outside
a) This command link all the access-list configure with the "acl_out" alias name to the outside interface. You must figure out, access-list is apply to the outside interface because the request (your users) come from the outside but the the filering rules are apply to the incoming packets of the outside interface.
That's it
