Well if you control the endpoints and can pre-deploy the configuration xml file and anyconnect posture client, you don't need the redirect ACL. Which saves on configuration and complexity. You can also manually provision the client, but browsing to the CPP webpage.
However if haven't pre-deployed the anyconnect client and xml configuration file and you want the client to automatically be redirected to the CPP to provision the agent and configuration then you will need the redirection ACL.
So it's not necessarily about best practice, it's about your scenario and if the endpoints have the configuration/agent. Ideally IMO you'd pre-deploy the necessary configuration files and anyconnect agent, then you don't need the redirection ACL but just rely on the call home list.
