The main purpose of ASA is TLS proxy. Technically speaking, you could put the ASA behind a NAT device as long as it can establish TLS connection with endpoints (cell phones).
The down side is: since this is not an "example" scenario, you'll have to fine tune the ASA config, which adds more complexity to troubleshooting.
Michael
http://htluo.blogspot.com