I think you can achieve that by disabling the "User Controllable" option on AnyConnect profile. In that case the users would see the AnyConnect window, and only after they log into the VPN they would see the Windows logon screen. However, it is not always advisable, for example if the users should be connected to a wireless network then they would need the wireless connection to be completed before they can connect to the VPN. To fix this issue you would need to enable the credentials caching for the wireless connection.
