Correct.  The sysopt conn permit is going to bypass any zone/interface for the traffic coming in on a tunnel.  Now, you could put a vpn filter on the side of concern to control pre-encrypted/post-decrypted traffic, but in my testing I did not see tha...