Ideally there would be two DMZ segments off the Firepower pair - DMZ-out and DMZ-In. The ASA has an outside and inside interface in each of those and is setup just like a normal ASA.
The policies on the Firepower pair would be to have a static NAT for the ASAs outside interface and an Access Control Policy allowing inbound tcp/443 and udp/443 to the ASA outside address (Firepower outside to DMZ-Out). A second ACP would allow inbound traffic from the VPN users (and the ASA itself) from DMZ-In to the Firepower Inside zone.
