Could it be possible to upgrade Anyconnect from 3.x to 4.x by pushing from packaging tool while users are connected through VPN?  Or using the web deployment is the best way to upgrade remote users anyconnect clients.